The template, fully assembled, five days before the 2016 election

Victurus Libertas publishes "Cicada 3301 Hillary Clinton Pedophile Ring Investigation Latest" on November 3, 2016 — under a 3301 cicada banner. Everything QAnon would later be is already in it, and the byline is a puzzle organization that never authorized any of it.

what the post asserts2016-11-03

// the anonymous insider, established as an in-house asset
"It's also being leaked by FBI Anon, who is a friend of this channel"

// the apocalyptic payload
"If the full scope of the horrors are exposed, the American and
British Governments would fold like cheap lawn-chairs."
"Hillary has lost all her power. Even if she wins, she will be indicted...
What comes next is a potent mixture of treason, espionage and pedophilia."

// the puzzle as prophecy — future proves past, a year early
Pi Mobi posts a cryptic message; two weeks later the FBI reopens.
"Late October pedestals will crack open" — read backwards as a hit.
"Those who would destroy us with lies will themselves be destroyed by truth"

// and the chain of custody it claims
FBI Anon posts on 4chan July 5 → Guccifer, DCLeaks, WikiLeaks follow.

Anonymous federal insider, elite pedophile network, imminent indictments, governments collapsing, a coded puzzle whose old messages are re-read as predictions once events arrive — a full year before Q's first post. The finished product existed. What October 2017 added was a name and a board.

Note also which post the chapter 07 entries sit next to. On November 3, 2016, SGTreport was pushing a Clinton pedophile network. Pieczenik said she would be arrested over one on November 1. Prince repeated it on November 4. This post is the same week, from the channel that would ask Steele about Cicada in February and host FBI Anon in August.

u/Drpbox — the Reddit trail, thirteen months before Q

The account u/Drpbox is tied to joebillionairesdog@gmail.com, an address Schoenberger identified as his own in a June 1, 2018 email to Dale Currie — "I only use joebillionairesdog@gmail.com for paypal" — in a thread where the PayPal notification itself is addressed to Thomas Schoenberger. Drpbox posted that address publicly in a comment on r/UCI.

The comments themselves. Four public Reddit captures from the Q++ folder. What ties them to Schoenberger is the email record above, not the screenshots. The undated ones read "3 years ago" when captured, so they are dated here only as far as the capture allows.

This is the single most useful artifact in the corpus for reading the original notes. Fourteen months before Q, the same account is doing all four things at once: seeding a hack payload, vouching for the proto-anon persona, recasting an anonymous puzzle as an insider leak channel, and running the Weiner storyline that Prince and Pieczenik will be repeating on Drudge six weeks later.

"I have known Thomas for years and he works for me"

Video context for the Cornwell Biss material below. · Watch on YouTube ↗

An email from Tanya Cornwell Biss, forwarded to a third party. It is the single most direct statement on record about the relationship at the center of money path 03, and she wrote it herself, in capitals, unprompted.

Three separate things are established here, and none of them require trusting her about anything else in the message. She describes Schoenberger as working for her and as the introducer to a named political circle. She describes herself as directing him — "the targets I put in front of him politically" — which inverts the usual assumption about who was steering. And the register is a one-hour ultimatum with a threat to ruin a lawyer's client, delivered to the wife of the attorney in that lawfare pipeline, framed as mercy.

Set it beside the June 2019 Biss email in chapter 05, where the attorney tells her that when Schoenberger opens his mouth he lies. In the same season, one half of that household is warning the other away from him while she is writing that he works for her.

The "HAZMAT" email — four months before the first drop

Tanya Cornwell Biss's June 30, 2017 email predates Q's first post by four months and is citable from the Steele v. Goodman filing at page 31. It sits directly under money path 03 in the network map above, and it is the reason that path is worth chasing rather than merely noting.

Sevens.Exposed — a quatrain, a Q.mp3, and a date that predates everything

Schoenberger states in an unlisted YouTube upload titled on-screen "The Secret History of Q" that he authored a Nostradamus-styled quatrain — "Quand l'escritue D.M. trouvee…" — and gave it to Richard Todd Miller (@KryptosJournal) on April 19, 2017 to encrypt for a puzzle project called Sevens.Exposed, co-created with Michael A. Levine and Richard Lech.

The video's grievance is that Miller stole authorship credit. It is not a denial of producing prophetic, coded, Q-shaped material six months before Q existed — which is what makes it usable. The reply thread from Kryptos Journal contains a gematria-style numeric cipher.

Identity chain confirmed via the Sevens.Exposed thread, Feb–Apr 2018: "Z" = lethargiclemur@gmail.com = "Kryptos Journal" = Richard Todd Miller, introduced Feb 28, 2018 as "Z, from the sevens exposed puzzle"

Eight months before Q, Victurus Libertas asks Robert David Steele about Cicada 3301

Robert David Steele's Public Intelligence Blog publishes the question list for a Victurus Libertas interview. Two of the questions are the entire thesis of this file, asked in public, in February 2017.

Read what is actually being asserted. Cicada is recast as a government program. A "creative" who can forecast events is placed at its origin — the precognition framing of chapter 10, dropped into an intelligence-adjacent story. And WikiLeaks and Cicada are declared connected on the strength of a number.

The same questions cover Epstein, blackmail of named senators, an intelligence-community civil war, and whether a populist civil war is coming. Every load-bearing element of QAnon is present in one document — the anonymous insider, the pedophile blackmail network, the coming civil war, the coded puzzle — eight months before the first Q post, in an outlet run by a former CIA officer, prompted by the channel that would receive an authored Q script in December.

"FBI Anon breaks silence" — the broadcast infrastructure, two months early

The channel description: after seven weeks of silence, their FBI Anon granted a Q&A; much of it confirmed what they had already suspected; they had been discussing what looks like an attempt to start a civil war in this country.

This is the format Q would run on, already operating: an anonymous federal insider, periodic silence followed by an exclusive return, civil-war framing, and a husband-and-wife channel supplying the broadcast. 2,851 subscribers. The audience was built, tested and warmed before the persona that would inherit it existed.

The same channel appears three separate times in this file: asking Steele about Cicada in February, hosting FBI Anon in August, receiving Schoenberger's authored Q script in December — and its contribution revenue jumps fourteenfold across that year. See the 990 chart in chapter 05.

The script sent to Victurus Libertas

An email from "Th Stg" (tstger13@gmail.com) sends Victurus Libertas an authored QAnon Q&A titled "Q anon speaks! End days prophecy is coming!" — and forwards it privately three minutes later with the note "Private. he he he.."

The source .eml carries passing SPF, DKIM and DMARC. The .eml is the evidentiary object; every transcription of it is a reading copy. Cross-reference the 990 chart in chapter 05: this is the outlet whose contribution revenue jumps fourteenfold in the year it receives this.

Three emails, ten weeks, three incompatible positions

Private: we planned to introduce Q on September 26. Semi-private: Q was modelled on Cicada. Public: Q is probably a CIA and Israeli psyop. He is not confused. He is running three registers at once for three audiences, and the deflection script is the one written to be forwarded.

"Why are you promoting QAnon?" — asked to her face, in 2018

Four screenshots from the Unity4J Discord, dated July 25, 2018. PistisSophia is Lisa Clapier. LESTAT is me. The exchange is the whole thesis of this file compressed into eight minutes, and it happened three years before anyone was writing papers about it.

Witness account · Arturo TafoyaI was in this room. The screenshots are mine, taken as it happened.

Unity4J Discord, July 25, 2018 · four consecutive captures, 5:17–5:26 PM

I asked her directly why she was promoting QAnon, pointed out that Q had called WikiLeaks compromised and attacked it, and named her: "you are snowwhite in twitter." She answered that some accounts claim to be Q supporters but that wasn't the narrative as far as she was aware. I pressed: Q followers were harassing Julian's mother. "why no one is helping us bring q anon down?" She replied that no one should be harassing Christine, that I should pass any accounts along and someone could deal with them, and offered to talk after the broadcast.

What I wrote, in the moment: "that can discredit wikileaks and us in any moment its a ticking bomb and a lie 100%" and "QAnon will cause way more damage, and its getting to the point of chaos because its already madness." Her reply was to ask whether this was the first movement I had witnessed, and then to post the Unity4J State of the Movement Address.

Cicada 3301 as a property, twenty-four days before Q

A First Amendment to an attachment agreement, dated October 4, 2017: Thomas Schoenberger ("professionally known as Thomas St. Germain"), Michael Levine and Richard J. Lech, as "Owner," with Insurgent Media LLC and Cat Entertainment. The subject is a film, TV, game or new-media project "based in whole or in part on the online puzzle/alternate reality game currently known as 'Cicada 3301' (the 'Property')." The chain runs back to agreements of December 9, 2015 and April 4, 2016.

The puzzle nobody has ever proven authorship of was being licensed as someone's property through the whole run-up this chapter documents.

"Fox asked me to give a nod to Rabbit … a month before Q"

Asked directly when he started Q and who helped, @SophiaMusik1 — Schoenberger's account — answers with a Cicada 3301 "Follow the White Rabbit" video and: "It started in Sept. Fox asked me to give a nod to Rabbit. Sept, a month before Q." Then: "I never posted on 4chan … I only said there was a new entity called Q, as we have done with Z." The DM shows no year; the question refers to control being "stolen in late november."

A separate email from the same Th Stg address, also undated, subject "On the Cicada video, can you now post": "Operation Q has begun. Follow the breadcrumbs."

Both are his own statements, filed as claims. What they add is that the "creator" story was being told from inside Cicada's orbit, not only by Chavez.

wikileaks.shop — brand impersonation with the campaign hashtag in the menu

Captured in August 2018 while observing the Unity4J Discord during its formative period: a WHOIS export and a live site capture showing wikileaks.shop operating as "The Official WikiLeaks Shop" with no infrastructure, registrar or jurisdictional relationship to WikiLeaks. The legitimate outlet was shop.wikileaks.org, a subdomain on WikiLeaks' own DNS.

Enzenada Cloud forensic memo OSINT-2018-WLSHOP-001 · observed Aug 2018, documented May 18, 2026

The WHOIS export that produced this listed six domains together: qanongear.com, veteransonpatrol.com, qanontruth.com, wikileaks.org, shop.wikileaks.org, wikileaks.shop. QAnon merchandise, the Tucson "Veterans on Patrol" operation, and a counterfeit WikiLeaks storefront surfacing in one lookup. Independently, in a recorded 2020 call, Manuel Chavez III walks through the same clustering and asks how those domains ended up next to each other — the same anomaly, found separately, years apart.

It was reported at the time to Jack Posobiec, who dismissed it. Posobiec sits in the facilitator column of the notes' own table, and is one of only two people the DEF CON account names as present in that room.

A second storefront: the Shop link on wikileaks.org itself

The WHOIS work above is about wikileaks.shop. A separate pair of captures sent to this desk shows a different oddity: the Shop button on the wikileaks.org homepage points to https://wikileaks.spreadshirt.com, both on hover and in the page source.

This desk checked the Wayback Machine. Captures of wikileaks.org from Nov 12, 2017, Mar 1, 2018 and Aug 15, 2018 all carry a Shop link to wikileaks.spreadshirt.com, so the captures are accurate for that period.

Clapier's prophetic register, in her own words

Video introduction. Clapier in her own voice, before the email below. · Watch on YouTube ↗

An email from PistisSophia@protonmail.com — confirmed as Lisa Clapier — to Beth Bogaerts, copying Schoenberger, Mindy, Genki, Hamilton and Tanya Cornwell. The prose is messianic disclosure language and it endorses QAnon by name: Q is assisting whether you like it or not, transparent disclosure is coming.

It also vouches for Schoenberger as chosen — that he may be taking the public hit to protect the truth's emergence, that she can confirm he was chosen, and that she was humbled when she learned by whom.

Set beside the quatrain, this is the stylistic match that matters: same messianic framing, same cabal-and-disclosure vocabulary, one in verse and one in prose, three weeks apart in the same network.

PDAnon — two independent attributions, eight years apart

In June 2026 Schoenberger writes that "PDAnon was Chavez. I have the proof somewhere…Him admitting it." That alone would be a claim. It is corroborated by a contemporaneous and entirely independent source: Bret Hirsch (@brethirsch), December 12, 2018, publicly naming PDAnon as "the idea behind Q & my friend @defangolives" — eight years before the confession.

Defango was also PDAnon's same-day first amplifier and sole canonical host: a February 6, 2018 Periscope plus a Steemit article slotted as "part 6" of his own Epstein series. Read as a whole, PDAnon reads as a recovery move after losing control of Q, not as an origin.

A third attribution. On August 11, 2018, Valor (intelvalor), a member of the same Cicada group, wrote to me: "I know Defango was part of the CJ group, as well as PEPE, but he was removed from the group and it was remade. CJ was also PDanon." It does not cancel the two above. Read together, PDAnon looks less like one man and more like a persona used inside a group that included both Defango and CJ (CJ, Lala and the brood).

The denial that names five other founders

Replying to a draft overview, Schoenberger writes that he never fought over QAnon and has never even been on 8chan — then states it was founded by Beth, Paula Davis, Lisa Clapier and Dan Vazina, who hid their roles with the exception of Clapier.

Same structure as 2018: deny personal involvement in the same sentence that demonstrates detailed operational knowledge of who was involved. The denial is the claim; the roster is the evidence.

Jim Watkins' virtual background

In a Zoom appearance, the owner of 8chan sits in front of a virtual background of a cicada with a red Q drawn over it. Nothing about it requires interpretation or verification. Pull the frame.

Paul Furber as lead author

Furber — listed in the mouthpiece column of the notes' own table — is forensically established as the lead author of the Q posts. The notes had him as a distributor. He was upstream of that.

"We had planned to intro Q Sept 26th"

Asked about Q, Thomas writes to me that Beth asked to include "Rabbit" in the puzzle, that on 4chan "we also did a huge question mark," and then:

Th Stg → author, subject "Q". His account of himself; the September 26 date matches the planning line in chapter 09.

Scripting what I should say about Q

After forgiving Defango and going on his show, Thomas writes to the group: "Well I distrust q." Six days later he sends me, ready to paste, a comment for the QAnon YouTuber Wardrummer, written in my voice: "I live in Latin America, the playground of the CIA … What if I am right and Qanon is a Psyop, possibly created by CIA and Israel?" The line matches what he told me in private: Q was his idea, taken over by intelligence.

Th Stg → author, "I would post this to wardrummer," Jul 16, 2018. I did not post it.

“You passed them, Lestat, early on”

Between the Kappy-on-air moment and the October threat, Thomas sends me a short note of reassurance about my standing. It is useful for a narrow reason: in his own words, in his own inbox, he confirms I was initiated.

Th Stg (tstger13@gmail.com) → author, Sep 27, 2018. He is a documented fraud and his claims about Cicada’s legitimate chain of authority are not adopted here. This line is kept because it is him, in writing, contemporaneous, confirming my role inside the network as he was running it — a point later disputed by people who were not there.

"Leave me out of your Defango and Q dramas"

By October I was speaking publicly about Q and Cicada. Thomas: "You gave me your word you would not be speaking about Q or Defango … Cicada behavior does not include publicly speaking about Cicada." The next day, subject line "If you wish, I could put out a pgp sign message stating that you're kicked out of cicada":

Th Stg → author (Beth copied on the first), Oct 12 and 13, 2018.

“Would you like every screenshot on your phone made public?”

Fifteen days after the “you’ll be destroyed” message above, the threat was made literal. Not about Cicada this time, not about Q, not about a public account of either — about the contents of my phone.

Two things to notice. One, the stepping-up: the weapon moves from reputation (“kicked out of cicada”) to private material he claims to have (“every screenshot”). Two, the format: a yes/no question. The point is not the answer; the point is to put the question in writing, so that the next thing I do carries the cost of ignoring it. This is chapter 12’s playbook arriving in my inbox, dated.

Th Stg (tstger13@gmail.com) → author, Oct 28, 2018. Whether he actually had any screenshots is a separate question and is not resolved here. The threat itself, in writing, is the artifact.

"I would rather see Cicada destroyed than used for evil"

I wrote to the Cicada members, Levine, Z, Juno, Richard Miller, Python and others, asking them to make Thomas step down. On Q:

Author → Cicada members, "Hello please respond." Nobody backed it. Forwarded to Cullen Hoback in 2022.

What the others answered

Some members answered with the principle I was defending. Richard Miller, the day after my letter:

Members → author. Even the member who disagreed with me confirms what the war was about: Q.

"Would you like to join cicada?"

How he recruited long before me. In January 2015, writing as Thomas and as Sophia Musik from the same music address, he meets a Richard Miller and asks him to join Cicada within the first message. This thread doesn't say which of the two Richard Millers in this file it is. Minutes later he gives the pitch he would give me in 2017: "We are white hats."

"Cicada does not belong to you"

In May Thomas forwards me a lawyer's note from Insurgent Media about the Cicada film deal: "We extended until August and need to get these signatures before we send out the demand letter claiming we have rights." Seven months later I write to Michael Levine, co-holder of the trademark: "Cicada does not belong to you, the sony deal is not happening … Hand over your part of the trade mark to Z or genki."

Th Stg → author, "Fwd: FW: Cicada," May 8, 2018 (forwarded to Francesco Grassi, 2021); author → Levine, "So?," Dec 18, 2018. The contract itself is in chapter 09.

"You are no longer a cicada, you never were"

November 21, to Thomas: "just to make it official, your are no longer a cicada, you never were." December 17, to the members: "I WILL DO A LIVE STREAM IN 2 HRS … ABOUT ALL THIS." January 1, 2019, to a YouTuber: "Im gonna blow up he started Q, I got the evidence."

From that point the same emails went to the people who later wrote the story: Jim Stewartson (2020), Francesco Grassi (2021), Laura Dilley (2021–22), Cullen Hoback (2022). Chapter 21 is what happened to the credit.

Christmas Day

Inside the span above, after Thomas had called me a “fake cicada” on the thread, I wrote the group — Foxfire, Hamilton and the others — twice. The first line names what the arrangement had cost by then:

The second, minutes later, is me addressing myself in the third person because by then I was not sure who the “I” was:

The Nuclear video in chapter 15’s aside is the next day’s answer to that night. The record isn’t only the art.

Author → group thread (Foxfire2112, Hamilton and others), Dec 25, 2018, two messages minutes apart. Kept here with the dignity that line still deserves.

I named the recruitment to her face, in writing

Nine days after the YouTuber email above, I wrote to Beth Bogaerts (Foxfire2112@gmail.com, copied to the same address at ProtonMail) and told her, in one sentence, what had happened:

Her reply the next day did not deny the recruitment. It pivoted to her own hardship (“Since June, all I ever wanted was out”) and, in a follow-up the same day, to the characterization that she had tried to warn me and I had brushed her off (“we all have dark sides”). I keep that reply paraphrased, not quoted; the trueblood chapter’s rule about not reproducing her private emails stands. The point survives the omission. The natural response to a false accusation of recruiting someone into a defamation network is to say you did not recruit them. That is not what she said.

Author → Foxfire2112 addresses, Jan 10, 2019; Foxfire2112 → author, Jan 11, 2019. The recruitment thesis is not retrospective reframing: it was named in writing while the recruitment was still happening. It would be another four and a half years before anyone else wrote it down (Dilley’s July 2023 voice notes, chapter 20).

Hamilton: the other kind of silence

Not every withdrawal from this story is Beth’s. Hamilton — one of the two people I invited into Cicada in spring 2018 (the aside above) — pulled back for the reason people usually pull back. On October 13, 2018, in the middle of Thomas’s threats, he forwarded me one of Thomas’s messages with: “FYI, bro wanted you to see this. At the hospital now and will try to speak to him tomorrow.” He was warning me while his family was in acute care. Three weeks later, on October 31: “I have a newborn and a wife who continues to need medical care. Therefore, please respect my request to remain out of this thread and matter entirely.” From 2019 to 2021 his inbox ran on an auto-responder saying the same thing. The withdrawal was signed, dated and reasoned.

It did not hold forever. On April 3, 2021, hours after I had been removed from my home by the police, he wrote a short conciliatory message. I answered with a sequence of furious emails in twenty-seven minutes that didn’t deserve a reply. On November 4, 2023 — the same evening I wrote to Beth asking “why have you turned your back on me” — I wrote the same question to him, with the subject line “Bestman.” He was going to be the best man at my wedding. He didn’t answer. In September 2024 he came back: a one-word email, “hi.” We reconciled.

I keep this here because the chapter 20 rule about Beth cuts in two directions. The pattern around her is one thing. The pattern around someone who had a reason is a different thing. Confusing them would be the same move the rest of this file is about.

Hamilton (hami1ton@protonmail.com) ↔ author, Oct 13 and Oct 31, 2018; Apr 3, 2021; Nov 4, 2023 (subject “Bestman”); Sep 2024. Quotes are from his messages to me. He is named here as he is already named in the spring 2018 aside above and in the Nov 2018 list of recipients in section III.

"You were right"

In January I wrote what I had expected from the group:

Author → member, Jan 11, 2019; Jared → author, "Duudee," Apr 28, 2019.

“I have feelings too and have lived the last 2 years scared”

Five months after I named the recruitment to her face (above), on a thread called “Block me?”, I wrote her a short note:

Her reply ran the same move the Jan 10 entry already describes — upset, apology, pivot — and closed on the one line worth quoting here, because it is the whole move in nine words:

I was the one taking the public hits. I keep this single line because it is the clearest version of the structure, in her own voice; the rest of her private emails stay out, per the chapter 20 rule.

Author ↔ Foxfire2112, “Block me?,” Jun 23, 2019.

“Please don’t share these”

Through the second half of 2019, Beth filed stalking and extortion complaints against Thomas with the Napa Police Department (case Npd19-4360, with filings and follow-ups in August and October) and forwarded her own submissions to me across the same months. On December 26 she sent them again with a cover line:

I kept my part of that. Her reports are not reproduced here, only the fact that she filed and the fact that she asked. This is the whole move in one request: a private file of her own victimhood built in official channels, forwarded to the person who was taking the public hits, with the demand that it stay invisible. Chapter 20’s rule about her private material stands with a single carved-out exception, which is this entry: that she filed, that she forwarded, and that she asked.

Beth (Foxfire2112) → author, forwarded Napa PD submissions, August and October 2019, with the “please don’t share” cover note of Dec 26, 2019. The reports themselves are hers. The forwarding, the dates and the quoted line are in my inbox. The chapter 20 note is amended accordingly.

“I will not permit Beth to manipulate me”

Another member of the circle, Esteban Trujillo (ma91c1an@pm.me), writes to me independently and names the pattern I had named to Beth’s face ten months earlier (above):

In the same thread: “I published an interview with you in the Cicada Files, and I back you to this day.” Not a chorus, but a second voice: a contemporaneous third party reading the same operator pattern around Beth from his own vantage, and saying so in writing.

Esteban Trujillo → author, Nov 9, 2019. Esteban is also the person Richard Miller handed sevens.exposed to, documented separately in chapter 14; his later arc is his and is not adopted here.

One comment, one report: War Drummer

2018. I was already sick of QAnon and didn't know what to do about it. I had no platform, no audience, and YouTube was doing nothing about that content.

One day I came across the channel of War Drummer, one of the movement's big names at the time. He mixed Bible readings with political conspiracy, had 23,000 subscribers, and even sold a "Q army anthem." I left a comment mocking his overdone voice. Honestly, I just wanted to see what would happen.

He made an entire 26-minute video about me. It's called "Qanon - Vampire trolls and threats - urgent message!" Yes, urgent message. Over a comment.

He said my name and sent his people after me. I got death threats, accusations of pedophilia, and one guy told me he would find me with facial recognition. The usual with that crowd.

But in doing that, he broke YouTube's rules on camera. I reported it. His main channel came down. Ten hours later he was recording from his backup channel, literally called "The Back-up," asking his people to stop going to my profile because "it's causing problems."

One comment and one report. My first steps against Q, when nobody was paying attention to me. But I learned something that served me later: you don't need to take these guys down. You just need them to trip over themselves.

Revisiting Wardrummer. The 2018 episode, revisited · Watch on YouTube ↗

If nobody inside would do it, I would do it on camera

Nobody inside would act, so I did it on camera: 40+ livestreams from May to December 2019, most of them two to four hours long. A selection:

Re-uploads as The Conspiracy Distillery on Rumble: Defango vs. BabyQ · QAnon and the Tea Party · Q Super Heroes · Catharsis of a PSYOP · WikiLeaks vs. Wikistrat · McChrystal + Flynn

Channel stream log (titles, dates, durations) held by the author. This is the public record that predates the first journalist contact in the table in chapter 21.