Who is speaking, and how many of them are there
In one lineWho is actually speaking: insiders briefing journalists while attacking the record, and accounts that are not who they claim.
Two problems run under everything in chapters 09–15: people presenting as credible insiders to journalists while attacking the record in public, and accounts that are not who they say they are. This chapter is the forensic side of both.
Z, Kryptos Journal, and the other names
The chain from chapter 09 — "Z" = lethargiclemur@gmail.com = "Kryptos Journal" = Richard Todd Miller, introduced by Schoenberger on Feb 28, 2018 as "Z, from the sevens exposed puzzle" — extends across display names on the same address: Kryptos Journal (Jul 2017), monkaS (Jul 2018), LahnIsland (Nov 2018), Praxises (Nov 2020), plus richard@kryptosjournal.com. The middle name is corrected by inner-circle correspondence: Todd, not Allan — there are two Richard Millers in this orbit.
Fried Organ
Three incompatible attributions: Miller (this desk's working read), Kristian Smith (a literal reading of the email chain that supplied the address), Microchip (Schoenberger and Defango). Smith is himself believed inside the circle to be a Miller persona, which would collapse the first two. Not resolved; not used as a load-bearing link anywhere in this file.
1,260 pastes and a document called "Vampire Hunter: lestat"
Manuel Chavez III's (Defango) Pastebin archive runs to 1,260 entries over three and a half years, with more than 630 combined references to this author and a targeting document titled "Vampire Hunter: lestat." Set that beside the DEF CON account of chapter 11: the man offering the origin story as a counter-operation was running a sustained file on the researcher documenting the dates around it.
Two stories that cannot both be true
Cory Daniel (@ThePhoenixEnig1) argues that Schoenberger "handled" Isaac Kappy — and, in the same body of attacks, that this author was "psyoping" Kappy. His ~2020 Redpill78 interview and his 2026 posts contradict each other on who did what. Privately, he told this author Schoenberger was the real bad actor and promised corrections, then reverted after the Dilley fallout. He is on the plaintiff's witness list (chapter 14, entry 22).
The encoding signature
Six accounts share one house style: a "cipher" that is trivially reversible and always resolves to a name or slogan — the opposite of how the real Cicada 3301 puzzles worked. The ciphers are built to be solved, which is to say built to be noticed.
| Account | Encoding | Resolves to / what it posted |
|---|---|---|
| @origo_q May 2020 · 0 followers | hex bio | "HRC same team DJT"; "Operation hijacked by 17"; "Remember FBIAnon?" |
| @4a61636b Jul 2019 · 9/9 | handle is hex | "Jack"; unprompted denial of being #ThomasSchoenberger, #Cicada3301, #Shadowbox, #BunnySec under a Rocco Castoro thread |
| @kill_rogue Oct 2017 · Android | backwards-only morse | "DO U NOT SEE IT"; "I didn't make my cipher hard enough" — denies any link to EyeTheSpy; treated as a separate node |
| @EyeTheSpy → @FollowThe17 → @EWillHelpYou | hash rechunked as colour swatches | 60 hex characters fitted to a reading (a real SHA-256 is 64); later self-enumerates a persona chain |
| @EzAsCoWa Dec 2019 · Android | mirror + Caesar-11, first word only | "Goodman Emerges" — second word left in plaintext |
| @FollowThe17 motifs | — | "7 Chambers. 7 Names. 7 Exposed." · "Q wave. Q.wav" · quatrains "and also what is happening before your eyes" |
The FollowThe17 motifs are Sevens.Exposed motifs — the puzzle project of chapter 09, the Q.mp3, the quatrain — surfacing in 2019–2020 on an account presenting as an independent insider.
The wrong-sock slip
Under a @FollowThe17 thread, a follower thanks "Eye" for the Q&A. The reply — "My pleasure" — comes from a different account, @JonnyMa94001886 ("Esteban's Poltergeist"). Two days apart the two accounts post the same phrase, "on both sides." One operator, two hands, answering for the wrong one.
The World's Hardest Puzzle – Episode 6
Aug 29, 2026 · 33:32 · YouTube ↗
The episode cited above, "The Key is All Around You," with Thomas Schoenberger and Michael A. Levine.
Independent confirmation: "the central node"
The Network Contagion Research Institute's report The QAnon Conspiracy documents @followthe17 as "the central node of this operation" for the #SubpoenaObama coordinated-inauthentic-behavior campaign: first post at 2:09 AM EST on May 13, 2020, and the tag going from zero to 42 tweets in the same minute. Published, third-party, methodologically documented — not this desk's inference.
Two device families, and one account that is a person
The dated posts of @kill_rogue, @EzAsCoWa and @EyeTheSpy are 100% Twitter for Android. The @doqholliday / @WyattEarpp_ cluster (Nov 2019 – May 2020) is essentially 100% Twitter for iPhone. Internally consistent, and distinct.
@WyattEarpp_ was previously treated here as a Schoenberger sock. It is identified as Rebecca Morgan, a pro-Schoenberger ally running his grievance narrative — not Schoenberger himself. The Zack directive "help Wyatt on Twitter" (chapter 15) fits the corrected reading: an ally being given cover, not a puppet.
A858, and an email with one character in it
From a858de45f56d9bc9@aol.com — the handle of a long-dormant, famously unsolved Reddit hex-poster — an email arrives with SPF, DKIM and DMARC passing, sent from AOL webmail on Windows 10 (a third, distinct fingerprint). The body is one character: "Q". Attached: four DM screenshots with @Cozy_Chan about Schoenberger's Bruce C. Clarke / "Project Stargate" / Mozart Society claims and an undisclosed alt. Borrowed mystique, delivered to the researcher's inbox.
"The Q story is weird": his own account of A858
An email to me, under the subject "The Q story is weird," from an account showing the name Sophia Musik and an address that begins thomasschoenbergermusic. It says that "Z and I launched that Q puzzle in April 2017," that Q then "starts, with white rabbit, etc on 4chan," and that "A858, who is MI6, and his code name is Q gets pissed and comes on the scene." It closes with "I have been holding back, telling nobody…"
This is one party's account, written to me, and the email itself gives no evidence for the MI6 claim. It is filed here because the A858 handle is the one that emailed me the single character "Q" in 2021 (previous entry).
One line from the same account: a named person "took over" a858
Six months after the "Q story is weird" email, the same account sends a reply that includes the line "And everybody knows that you took over the a858 account James Lefeber." The name matches "James Lefeber aka Janon" on the Schoenberger v. Dilley witness list in chapter 14.
This is an assertion by one party. The line gives no source, and I have no independent record linking that person to the handle. The rest of the email is insults and a threat, not evidence, so only this line is shown. It is here because it is a second, different story about who stood behind A858: in December 2023 the handle was MI6's "Q"; in June 2024 it was an account somebody "took over."
"I do not code, I am not a computer person"
On tape, Schoenberger claims Cicada's creation, then says he does not code, and names Iona Miller, Ian Murdock and Bruce Cooper Clark Jr. as its actual creators. Two of those names are dead or absent by the circle's own correspondence (Richard Todd Miller, Nov 17, 2020: "Ian Murdock nowhere in sight").
This desk's priority on the Iona Miller connection is on paper: a February 22, 2019 email to Logos Media — "Thomas and Richard Miller are partners in that endeavor along with Iona Miller" — seven years before the podcast. The claimant is not revealing the roster. He is reciting names already in the record, and contradicting his own authorship in the same breath.