Confirmed by Stormseeker here

On the 27th of February, 2015, a forum user by the name of Johnnotjohn appeared on the forums and posted this message.

Hello, long-time reader, first-time poster here.

A strange thought occurred to me, and I felt like I should share it.

If is supposed to be a local news site for the area around Black Mesa, and if is supposed to be a dating site for the same area, isn't it odd that both sites are reporting unusually high server loads?

Also, I don't know if it's been mentioned yet, but Thomas Lee is an anagram of "Meet Halos."

He later went on posting until the 9th of March, where User Gunsrequirem revealed that Post # 6 had a hidden anagram "I AM HALOS". Several other users confirmed that they had their suspicions as well. Below are all of John's posts.

Posts: Edit

2/27/15 Post 1

Hello, long-time reader, first-time poster here.

A strange thought occurred to me, and I felt like I should share it.

If is supposed to be a local news site for the area around Black Mesa, and if is supposed to be a dating site for the same area, isn't it odd that both sites are reporting unusually high server loads?

Also, I don't know if it's been mentioned yet, but Thomas Lee is an anagram of "Meet Halos."

2/27/15 Post 2

"Tim Evans" = "TV in Mesa"

2/27/15 Post 3


I did an anagram search of Tim Evans after I noticed the Thomas Lee one. I would have posted it earlier, but I didn't want to start a wild goose chase involving every TV in the game. Apologies for that.

I'll keep my eyes peeled for anything else.

2/27/15 Post 4

If I were to take a guess, this is the code for the ASCII G-Man in the console.
Faed:21.32*16/129.52+1997.37;Which actually is 2000.0037245213093 milliseconds.

I'm curious about those numbers. It would have been simple enough to just encode 2000ms.

2/27/15 Post 5

I was working on that name. Nice job noticing the BMRF. With that in mind, I was able to get "Frank Abrams" = "BMRF as an ark"

It's a bit of a stretch, but it might be something.

2/28/15 Post 6 (Note, hidden anagram is bolded)

"I've been looking over some of the earlier pages of the thread, and I 
noticed that Storm said we were close two years ago, when the HALOS file
 was found. All of the work that has been done since then has focused on
 ultimately solving that one puzzle. Meaning everything Storm has done 
since then must have been subtly hinting at the solution to that puzzle.
 However, he might just be messing with us. Also, I personally recommend
 the 80s and 90s, corresponding to about a year ago. Lots of interesting
 stuff, including acronyms, anagrams, analyzing static, large amounts of
 numbers, and more. Old thoughts sometimes  inspire new thoughts. See if
 anything occurs to you while re-reading.

Just keep your eyes peeled, and you might find something."

3/1/15 Post 7

Doing a bit of research, it seems AES, Twofish, and Serpent all use key lenghts of 128, 192, or 256 bits. This means the password would need to be 16, 24, or 32 characters long. BENALOHPAILLIER is only 15 letters.

Rjindael, whichwas used as the basis for AES, can also be used with a 20 or 28 character password, in addition to those mentioned above.

This is just from the Wikipedia entries on those systems.

3/1/15 Post 8

Clue 6 pointed to the HALOS file.

Clue 5 gave the password "BENALOHPAILLIER."

Clue 3 was the first mention of HALOS, as far as I can tell.

Clue 4, however, doesn't seem to add much at first. But consider this: it gave a login "HALOS"

Combining the login and the password gives a total of 20 characters, which can be used as a 160-bit key for a Rijndael cipher.

3/2/15 Post 9

Here, John simply clarifys what he has said in previous posts to another user

I mentioned this earlier. 

3/5/15 Post 10

"congratulationsyouwonthePIZZA" is 29 bytes, but I can't help but feel it's related somehow.

Was the capitalization of "PIZZA" a part of the solution?

Edit: I checked the wiki. The cipher used ASCII characters, so the capitalization is intentional. Curious, considering the suspected encryption of the 752 hex code requires a case sensitive password.

3/6/15 Post 11

I've taken some time to look into the underlying story of the ARG, seeing as it is something Storm has repeatedly told us to do. While reviewing the clues we have been given, as well as the current established theories, a few points stuck out.

First, there is the connection between HALOS, Niobium, and pizzas. The first time all three were mentioned in a single clue was in the 'Tempus Omnia Revelant' page, posted after the trail went cold on the HALOS file.

There is a long-standing that Niobium was being smuggled in on pizzas and used to build an AI called HALOS. While this would explain the large portion of the budget being spent on pizza, it doesn't explain why the Niobium was being smuggled in the first place. The use of Niobium in the construction of an AI is established in whiteboard c0a1x_labboard_am1. However, from the same whiteboard, it can be inferred that Dr. Montero, often noted as an administrator, was aware that Dr. Bottomley was in possession of Niobium. Why, then, were measures being taken to smuggle it in?

My theory is that the Niobium was initially being used in the development of the Tau Cannon. After all, the usage of Nb alloys as a superconductor is often linked to its use in particle accelerators. This would explain why Dr. Montero was aware of its presence in the Biodome. However, if Nb can also be used in an AI, and Dr. Horn and Dr. Bottomley were secretly using for this purpose, they would need a way to smuggle in additional Nb so as to avoid detection. This is why they used pizzas. A stockpile of pizzas, while strange, would seem much more innocent than a stockpile--or worse, unexplained disappearances--of an element often used in jet engines (see C-103 alloy) and currently being used in the Tau Cannon, the destructive power of which we are all familiar with.

This theory doesn't replace the long-standing one, but rather acts to fill on some of the gaps, and make use of the clues which have been provided.

Second, understanding the significance of the pizzas, what is the implication of their theft by Dr. Stone and Dr. Welsh? Whiteboard c2a4x_labboard1 already shows Dr. Horn's frustration regarding one of the security guards taking and eating the pizzas. This is understandable, because it would mean that more pizzas would have to be ordered to replace the Niobium. But consider what would happen if someone made a concentrated effort to steal and hide as many pizzas as possible. Recall that the events of Half-Life 1 take place in May, while the diary entry from Dr. Welsh mentioning the plan to steal the pizzas is dated in either September or October, depending on what format was used for the date. Since we are still able to find countless pizzas scattered throughout the facility, and the large contribution of pizza orders to the Biodome budget, as well as their continued theft (see whiteboard c2a4x_labboard15). is still being seen as an issue, it would appear that this has been going on for several months--almost a year, in fact.

If something about the previous statement seems strange, that is because it should. According to the evidence presented above, Dr. Horn had been continuing to smuggle in Niobium using pizzas right up to the events of HL1. However, this seems to contradict IRC clues 2 and 3, which points to the recovery of Niobium at Holloman Air Force Base, and the subsequent continuation of project HALOS thereafter. I have several theories regarding this, but they are mostly speculation.

3/6/15 Post 12

If we're looking at elements, here are some fun facts. Element 22, titanium, is often alloyed with Niobium and other elements to produce superalloys for use in rocket engines and other assemblies. Additionally, niobium-titanium alloys are type II superconductors, with applications in MRI machines and particle accelerators. For some fun with 21: Scandium, element 21, was historically alloyed with aluminum for use in the Russian MiG.

Edit: For those who would rather not grasp at straws, here are some interesting thoughts I have on some of the clues we've been given:

IRC Clue 1: Applying the [Recipient] [Message] [Sender] format yields the message "Don't let him find us," from Dr. Welsh to Dr. Horn. Also, the version that appears in "Tempus omnia revelant," under a section evidently written by "HALOS AUTOMATED," adds an attempt to triangulate the source. That section also contains a list of Niobium isotopes.

IRC Clue 5: The inner code is designated as a message for Dr. Horn, to be sent by HALOS "in level seven cases." The inner code transmission is preceded by an attempt to connect to "User H," the subsequent sending of data, and the statement "SECURITY LEVEL 7 ALPHA." The clue also contains an attempt to locate the leak suspected in IRC Clue 3

If I were to take a guess right now, I would say HALOS is online and not friendly.

3/7/15 Post 13

Nice work! I've been pouring over all the whiteboards for clues, so I was aware of the change in the samples, but I never paid attention to the numbers. There is a good chance 21 may refer to the sample EP-0021. However, I not entirely convinced that 1 refers to the Anti-Mass Spectrometer. EP-0021 never technically went into it over the course of the game.

The mention of the switch in samples, however, reminded me of what was written on the whiteboard with the budget and the description of the cascade cipher. There is a not mentioning a specimen transfer from the Lambda complex to the Biodome.

Remember how the keyword for the SECOM cipher, "laseroptroniclinearinducercannon," was written on the same board as the ciphertext? This might be a similar case. After doing a bit of background research, and considering how the board mentions that the area is still under construction, we may need to widen our search for clues.

3/7/15 Post 14

A few days ago, I looked over the IRC clues to see if there were any clues the formatting. I reached the same idea regarding the [********] in IRC 4 at that time.

What strikes me as most notable regarding IRC 6 and HALOS.txt is the proxyhost, which is different from all previous messages.

My guess is that the IRC clues are transmission from HALOS. (IRC 1 included an intercepted transmission, as the Tempus page suggests)

Taken together, there are three adresses, which I've taken to indicate three HALOS sites. The first is 164, which intercepted IRC 1 and sent IRC 4. The second is 155, which I believe was built using Nb from HAFB. This one sent out IRC 3, with IRC 5 being a sort of automated "dying message" when the site was compromised.

The third is 345, which I believe is the newest site, set up by Horn after he received IRC 5, hence "you should bring pizzas," being code for Niobium to build a new computer to run HALOS.

I'm not sure how IRC 2 fits in.

EDIT: Perhaps IRC 2 was just a simple message, rather than a transmission from HALOS. That would explain the lack of the typical formatting.

3/7/15 Post 15

Perhaps something in the IRC clues can help us with the HALOS code. If only we had been discussing that earlier, say, in the last few posts.

3/7/15 Post 16

I'm not disagreeing with you. If the password works, then it works. Try it and we will know. In the mean time, I'll continue following Storm's other advice, and work out the story.

3/8/15 Post 17

It's from the PM from 0418_08151814, an alias of Stormseeker. It's on his page on the wiki. The PM includes several hints at the method of encryption.

3/9/15 Post 18

I've always felt that the phrasing "21 goes into 1" is indicative of 
some form of metonymy. Subject-verb agreement requires that "21" be a 
singular object. Youdon't say "21 somethings goes into so." That why I 
agreed with CPU regarding a reference to Xen crystal EP-0021.

It's mentioned quite a bit on some of the whiteboards. Also, since it's 
referred to as a specimen, I would guess that it was the specimen 
transfered to the biodome.

Either way, I would agree that the key probably references the biodome, 
and the encryption is probably referenced in the PM from code. 
Personally, my (metaphorical) money is on an AES encryption, since it is
 mentioned in both the PM and the whiteboards.

EDIT: Remember the OTR-style security breakdown from Code_'s PM? It 
mentioned cascade ciphers later on, but only a single cipher for the hex

Lost Post: Edit

One of John's postings was lost in an update to the forum. Luckily user flavrans9 saved it before it was lost. Post is as follows.

Since we have now returned to attempts to solve the HALOS file itself, I
 would suggest reading pages 64 onwards, constituting the final lead up 
to the file and all work done on it since.

I would also suggest looking through the hints given by user 0418_08151814, or Stormseeker as we now know him to be.

My personal thoughts on the issue:

The HALOS file, and IRC Clue 6, which pointed to it, was released after 
solving codes A-D, as well as all of the other IRC clues. In other 
words, all of the other puzzles had been solved, and the time had come 
for a true challenge in the form of the HALOS file. Furthermore, this 
implies that all of the clues necessary to solve this puzzle had already
 been given.

However, after a month without any progress, Storm created the "Tempus 
omnia revelant" page, with the hidden message "Seek Code out." This 
ultimately pointed to 0418_08151814, who identified himself as Code_ 
from the IRC. When his username was decoded as DR_HORN in early 2014, 
the connection was finally established, and a mysterious comment was 
added to the "752 Hex Code" page on the wiki.

I would take all material released prior to the discovery of the HALOS 
file to constitute the necessary clues to solve it, with the posts and 
PMs of 0418_08151815, as well as the remarks openly made by Stormseeker,
 and the aforementioned comment on the wiki, to be additional hints 
pointing to the solution.

One final point of interest is Stormseeker's insistence that we focus on
 the story. Under the abovementioned alias, he always told us to look 
into the connection between HALOS and Niobium. The AI connection has 
been well established, so maybe that figures into how we should think 
about the solution.

>TFW Gunsrequiem

Speculation Edit

From this we can discern several clues that HALOS is giving us:

  • Look over old threads, particular 70 - 80, for clues
  • Anagrams are essential to solving this
  • Thomas Lee is an anagram of Meet HALOS
  • Tim Evans is an anagram of TV in Mesa
  • Major Frank Abrams is an anagram of BMRF as an ark (may be a red herring)
  • The timer on is strange in that it has very peculiar equations. It is likely that the numbers in these equations will mean something later on
  • A lot of our passwords are too short to fit AES, Rjandael, etc. ciphers
  • We may be overlooking IRC clue 4
  • The Pizza theft has been going on for a year
  • HALOS may be online and unfriendly
  • Clues may again be hidden on whiteboards in Ciphertext
  • EP-0021 is likely the '21' from 21 into 1
  • IRC 2 may also hold clues pertaining to its transmission location
  • Working out the story and producing an accurate timeline may be useful
  • The '1' in '21 into 1' may be metonymic, meaning that instead of meaning literally 1 it could mean the leader or highest order of something (perhaps referencing the purity of the replacement sample?)
  • The biodome is relevant