Neal Rauhauser's playbook
In one lineThe same methods run on the left, around Anonymous, Occupy and Standing Rock, and one operator is documented on both sides.
Witness account · Arturo TafoyaI was part of these events. Where I appear, I tell it in the first person; every document is stamped the same way as the rest of the file.
Everything above treats the network as a right-wing object: former intelligence officers, Gulf money, a Trump transition. That framing is incomplete, and the incompleteness is the point. The same methods run through Anonymous, Occupy, Standing Rock and the anti-disinformation research scene — and one operator is documented on both sides of the line.
Neal Rauhauser is assessed here as the live node. Thomas Schoenberger, by 2026, is close to inactive as an individual operator; his significance is who he is allied with. This chapter is about the ally, the doctrine, and what it cost to get close enough to document it.
Neal Rauhauser 101. Brett Kimberlin and Velvet Revolution, Occupy, sockpuppet and persona-management accounts, and the Texas anti-SLAPP case · Watch on YouTube ↗
"Manipulating conspiracy theorists" — the method, written down
Rauhauser's 2016 doctrine describes calibrated encouragement and provocation against a target, tuned to a deliberate success-rate band: enough wins to keep them engaged, enough losses to destabilize. The stated outputs are despair or overreach — either the target collapses, or they overreach publicly and discredit themselves.
Read it as an operating manual and most of what follows in this chapter stops looking like a series of separate incidents.
Litigation as a deterrence instrument
His documented lawfare doctrine treats expensive, long-distance, lengthy, discovery-laden litigation as a tool: you do not need to win, you need to make one visible example of one critic so the others quiet down.
The shape of Schoenberger v. Dilley et al. matches that description — a suit with no apparent foundation, filed at distance, generating a docket that implies there is something substantive to litigate about Cicada authorship. See chapter 13 for the exact captions and the author's status in them.
Anonymous-adjacent recruitment → Welna → the paper
Per Dilley's own book manuscript, Rauhauser recruited her into an Anonymous-adjacent intelligence operation, and she found William Welna inside his chat rooms. Welna — with no academic research experience — then collected the Twitter data underpinning the QAnon paper, and disavowed the work in February 2025. That disavowal is now cited by the plaintiff's side against her.
This contradicts what she told The State News in April 2025, where the research was framed as a pandemic hobby and she declined to explain how she found Welna.
THE TELL
In a recorded conversation, Dilley and VelvetBlade remark on how odd it was that out of everyone available to Rauhauser, he assigned Welna specifically. They noticed. They noticed and proceeded anyway.
Dilley disavows Welna, in public
On September 29, 2026, Dilley (@ProfDilley) posted a thread saying she "completely disavow[s]" William Welna, describes him as a brief temp employee who assisted with data analysis for her around 2020–2021, says his contribution to the 2021 paper was "miniscule," and writes "I stand by the research, and I fully own it." That she posted it, and what it says about her own position, is documented. Her characterizations of Welna personally are hers and are not adopted here. This is a different disavowal from the one in February 2025 discussed above: that was Welna disavowing the paper; this is the paper's lead author disavowing him.
Parallel FBI tip operations, on the same Maltego graphs
@AmericanHacker DMs from June 2021 show Rauhauser running parallel FBI tip operations built on Maltego graphs — the same methodology Dilley later presents as her own innovation. He is also documented operating inside Jim Stewartson's Thinkin Project Discord.
The most useful evidentiary tier on that last point is not third-party testimony. It is Rauhauser's own tweets about working with the project, which a private source flagged in July 2022 — twenty-six months before anyone said it publicly.
A premise in circulation: that Rauhauser paid for Stewartson's Discord
Public replies from an account called @FINNAH4, in September 2022, ask a Dilley-circle account how it knew that Neal Rauhauser "set up and paid for" Jim Stewartson's Discord server. A July 2021 reply from @LouiseMensch is captured with them. The tweets are real and dated. The premise inside the questions is the poster's own and has no document behind it here, so it sits at Claimed and is not adopted.
Two public tweets that describe Rauhauser
Two third-party tweets, captured as posted. On September 15, 2018, @MarlaMHughes noted a new "researcher" called Velvet Blade, "close to Velvet Revolution which belongs to Bret Kimberlin, Rauhauser's close associate." On February 28, 2021, @MsPacNWer linked an archived page titled "WHO IS FUGITIVE NEAL RAUHAUSER?" The tweets are real and dated. The descriptions in them are the posters' own; neither is adopted here.
Named as an "orchestrator" of an op
On February 18, 2022, @HumanOfMind posted that she does not know the individuals stated, does not work with Raymond Johansen or Arturo, and is "not an Op." Her tweet quotes @MindInspired1 saying Libby Shaw and Neal Rauhauser "were part of the people setting myself and others up," that Rauhauser "reported me to the FBI," and naming "Beth B, Raymond J, and Arturo T" as "the orchestrators of that Op." This author is the Arturo T named. The accusation is @MindInspired1's and is not adopted; it is here because it is the public record of how the author was described.
"Join the hunt" — Rauhauser brings 8chan's creator into the room
The screenshot itself is straightforward and dated: nrauhauser adds Fredrick Brennan, introduces him as 8chan creator emeritus and notes he jabs them where he can now. Brennan replies. Rauhauser says they have a room and invites people to join the hunt.
That is the intake funnel operating in a single exchange, with the founder of the board Q ran on brought in as an asset. It also dates the Rauhauser–Brennan working relationship to January 2020, which is nine months before the Reddit recruitment drive and the sinkhole room described below.
THE OVERLAY IS NOT THE SCREENSHOT
The handwritten sign asserts that in 2020 Rauhauser, Cottle, Stewartson and Brennan formed a Discord group to coordinate a fabricated story about Jim Watkins, with Brennan recruited on a promise of getting even with the Watkinses. That is a serious allegation about four named people, it is unsourced, and it did not come from this desk — it is someone else's annotation riding on a real screenshot.
It is reproduced because the composite is what circulates and readers will encounter it whole. It is not adopted. The dated chat log is documented; the claim written on the sign is not, and this file does not launder one into the other by printing them in the same picture.
"This thread is turning into quite the confessional"
More of the public comment thread two captures in chapter 11 come from. Three accounts talk openly and warmly: nrauhauser, SophiaMusik — the channel identified throughout this file as Schoenberger's — and MarciaStockton. The subject is Aubrey Cottle ("Kirt").
- RAUHAUSER
- Cottle's plea timing was "a firm indication he was never acting as an informant"; says he shipped Cottle a workstation that was never retrieved from customs; describes escorting a ProjectPM developer's servers out of "my system" after they became entangled with Barrett Brown.
- SCHOENBERGER
- "They seized his devices"; calls Cottle "a genius"; says he reached out to him during #Buttsec and that Cottle "kept his word … I wanted him to not attack the women that were my friends."
- STOCKTON
- "The women you protected by that bold action are grateful. Chivalry isn't dead!"
Why it is here: chapter 12's finding is that one operator is documented on both sides of the line. This is the counter-disinformation side's most prolific litigant and the Cicada claimant in friendly, public conversation about a hacktivist both describe having dealt with directly. What either man says about Cottle's legal exposure is his claim and is not adopted here. The comments carry only relative timestamps ("2w ago"); the capture date is not established, so the entry is left undated rather than guessed.
The sinkhole, and roughly five hundred unvetted volunteers
Four sources, four routes, one funnel: the manipulation doctrine; a Matrix room created and labelled by Kirtaner (Aubrey Cottle) as "a sinkhole for real q crazies once plans enact"; a Reddit recruitment drive by Stewartson pulling in roughly five hundred unvetted people; and those volunteers being exposed to Rauhauser without disclosure.
People who signed up to research a conspiracy movement were routed into a room built by the people who had written down how to destabilize researchers. That is the gamification thesis in one sequence.
Occupy Wall Street, as read by the department that was watching it
DHS/NCCIC Bulletin A-0016-NCCIC · UNCLASSIFIED // FOR OFFICIAL USE ONLY
A federal bulletin assessing Anonymous operations — Occupy Wall Street, Operation Facebook, Project Mayhem with its December 21, 2012 culmination date, Operation Halliburton — alongside the tooling. It reproduces the Adbusters tactical briefing, the Tahrir-acampadas model, and the movement's own Pledge of Nonviolence.
It is included for one reason. Every element the later chapters treat as a manipulation signature — a leaderless movement, an apocalyptic date, a Guy Fawkes mask, a call to flood a physical location — is here in 2011, being read and catalogued by a federal agency, with the participants' nonviolence pledge printed alongside. The people in the street were sincere. The infrastructure around them was already documented, funded, and attended to. Those two facts have coexisted the entire time, and every chapter in this file is about what happens in the space between them.
Standing Rock, and the podcast that says the quiet part out loud
Wes Clark Jr. — video reference for the Standing Rock arc. · Watch on YouTube ↗
American Psyop (MeidasTouch Network / Bunker Crew, 2022) is a documentary podcast series built entirely on this premise. Its subject is Wes Clark Jr. — son of a NATO general and presidential candidate — and its stated thesis is that he was targeted by intelligence operations, surrounded by a religious cult, and driven into a breakdown while moving through Hollywood, The Young Turks, and activism.
Several consecutive episodes are Standing Rock. The published descriptions are explicit: he descends into madness preparing to leave; he arrives at the protest while experiencing a psychotic episode, attempting to fulfill what he believes is his destiny; the experience turns dark as figures from his past reappear; after he returns, familiar faces and strange new ones are waiting.
A bonus episode pairs Clark with Desiree Kane to discuss how their experiences overlapped and what that shows about threats to American democracy — an Indigenous participant in the same events, brought in on the record to corroborate the overlap. Another bonus episode brings in cult expert Steven Hassan on the undue-influence and mind-control tactics used against Clark.
WHY THIS CLOSES THE GAP
The series is edited and directed by Jack Bryan — already in this file's attribution ledger. So the strongest published account of operators working a left-wing Indigenous movement comes from inside the same small production world that has republished this desk's research without credit. It is not an outside corroboration. It is the same circle, describing the mechanism from the other end, with a major network's distribution behind it.
"American Psyop · Rebuke · Fake victims and fake experts." Cindy Gomez-Schempp's show (Spanish, 18 min). She reads the December 27–28, 2022 X thread in which the series' own account says it reached me while looking into Q's origins in 2020, that I "certainly helped add to our understanding," and that the interview was not used. My replies in that thread are on screen too. The show's title and framing are hers.
Set against Jim Stewartson's characterization on a recorded call — that Lisa Clapier's résumé runs through Anonymous, Occupy, Thrive, No DAPL and Standing Rock before Cicada and QAnon, and that Schoenberger was a low-rent operator until she arrived — the two accounts describe the same terrain from opposite sides of the political map.
The conclusion the file will carry: this is not a political network. It is a methodological one that has run the same playbook — anonymous authority, prophetic framing, a movement with no accountable center, a target isolated inside work he believes in — through an occupation, an anti-pipeline campaign at Standing Rock, and then a pro-Trump apocalypse. What stays out of scope is any claim about the water protectors themselves. Standing Rock was surveilled and infiltrated by actual private contractors; that is documented history, and it is not this file's to relitigate.
The honor trap
A named mechanism, defined by this desk from the inside, because it was run on this desk.
It works like this. Someone recruits you into work you already believe in. The obligation is built out of things you cannot refuse without appearing dishonorable: a shared cause, a confidence, a person who needs protecting, a risk you agreed to carry. Then the obligation becomes the leash. You are publicly attacked and cannot answer, because answering would break the confidence or expose the work. You absorb it, because absorbing it is what the code requires. No deception about facts is necessary at any point. The trap requires only that you have a code and be seen to have one.
CASE: THE RECRUITMENT AND THE PUBLIC POSITION
March 2022: a Gmail thread in which Dilley recruits me, praising my expertise. I supplied research, media documentation, and eventually hours of recorded interviews for her book, and received a formal acknowledgment in the peer-reviewed paper for that documentation.
Concurrently and afterward: six one-sided NDAs issued to sources; three concurrent accounts running attacks; an October 2023 harassment email chain; a private strategic advisor whose public attacks derived from her private framing; and, when she accessed my PC, the circulation of a claim that the conflict with Schoenberger had been fake all along — the precise inversion of an infiltration I had declared in advance to her and to five witnesses.
The structural fact underneath it, established in the entries above rather than inferred: she entered through Rauhauser's recruitment and her key collaborator came out of his chat rooms — and by mid-2022 one of her accounts was publicly minimizing Rauhauser as a harmless crank when his involvement was raised as disqualifying. Downgrading an operator from operator to crank defuses the association. It is a two-way shield in one sentence, and it protects the recruiter.
THE LINE, DRAWN DELIBERATELY
"She was on their side the whole time" is the reading, and it is not what the evidence establishes. What the evidence establishes is that she was inside the same recruitment chain from the beginning, that the chain ran through Rauhauser, that she shielded him publicly, and that the person who supplied her research absorbed the public cost of work she was credited for. Whether that was allegiance or capture is not documented, and the difference does not change what happened. Recruitment is provable. Loyalty is not.
This is why the mechanism gets a name and a place in the file. Nearly everyone in this document who was harmed was harmed while doing something they considered correct. That is not a coincidence in the sample. That is the selection criterion.
How to Plan a Digital Execution. A case study of the Michigan State research relationship: how it turned personal and financial, the DAT Project grants, unpaid source work, and the leaked messages · Watch on YouTube ↗
The infiltration, declared in advance
After a public meltdown by Dilley, I deleted my account and left Twitter, then came back when I heard it was continuing and that my ex-girlfriends were being contacted. While I was under attack and couldn't answer publicly, Schoenberger approached me offering friendship. I read it at the time as an attempt to exploit how depressed I looked.
I decided to accept and infiltrate instead, and, critically, to declare it in advance. I told Dilley and at least five witnesses. The December 2023 DMs are screenshot-documented: an intention to infiltrate the operation again, a request that the public attacks continue because they help the cover, and an explicit ask for a witness. Cullen Hoback documented it independently.
It ran roughly three years. It produced the FBIAnon confession from Schoenberger — the decisive break — plus the 2018 and 2025 emails in chapter 09, and hours of recorded interviews given to Dilley for her book. It also meant submitting again to a documented harassment campaign: roughly 69 videos in one archive of 675 targeting me specifically, in a collection running December 2019 to September 2020.
What it cost, stated plainly
Dilley knew and never believed it; she read me as Schoenberger-controlled. When she accessed my PC, she found the Schoenberger emails and PayPal transfers and circulated that the conflict had been fake and I had always been Schoenberger's friend. Others who did know exposed the infiltration publicly and mocked it. I kept going anyway.
I warned the group the attacks were too heavy and that I wouldn't be equally stable every day. When my cat was dying and I asked for help, the group turned away. After the findings went public there was no acknowledgment and no apology.
That is the honor trap working exactly as described, on someone who could see it, had been warned about it, and walked in anyway because the alternative was leaving the record incomplete. That someone was me. Documenting the mechanism does not exempt you from it.
The exchange, charted
Four readings of a private DM exchange between Dilley and me. The screenshot itself is not published; explicit sexual and medical wording has been replaced with neutral labels. What the charts separate is the point of the whole entry: an exchange can document an accusation without documenting the conduct.
12.x — The frontman and the apparatus
Attacking the frontman leaves the apparatus that built him intact. Kirtaner's "founder of Anonymous" identity was printed, amplified, and launched by a press-and-broker layer that also handled — and later misrepresented — the author.
Manufacturing Dissent: Leaked Preparation for Kirtaner's 2020 Launch as "Founder of Anonymous"
Barrett Brown · Aug 8, 2026 · Watch on YouTube ↗
The GiveSendGo Hacker Is Weird
Grifter · Feb 17, 2022 · Watch on YouTube ↗
Why this case
In February 2022, a YouTube video ("The GiveSendGo Hacker Is Weird", Grifter) tore into Kirtaner over the GiveSendGo breach, his taunting, and his list of hacks. The criticism lands, but it aims at the frontman. The video treats the "founder of Anonymous" title as Kirtaner's own troll. The record shows it was produced.
The credential
On August 11, 2020, The Atlantic published Dale Beran's "The Return of Anonymous," which put Kirtaner's founder claim into print. Kirtaner then used the article as his credential, pointing people to it as the piece that revealed his identity.
The amplification
On October 30, 2020, roughly four hours after Kirtaner announced his return, Beran tweeted that the leaderless collective was back "this time with a leader (their founder)," linking his own article. The tweet is still live.
The launch
Between September and November 2020, a Signal chat between Kirtaner and HiFi, published by Barrett Brown, shows the founder narrative being prepared with media bookings around it. HiFi calls it a larp. The author's evidence album is opened inside that chat.
Boston, Housh and Kirtaner: the Anonymous side of the same graph
What is on his own channel. Documented Gregg Housh, an early Anonymous participant, ran a show whose VODs are on the channel “Gregg Housh VODs.” Three of them are titled for Aubrey Cottle, “Kirtaner”: Episode #11 (Dec 8, 2020 on the YouTube page, Dec 9 in UTC; the description covers the OANN leak and “the latest Parler data”), Episode #13 (Dec 12, 2020 on the page; “some history behind the early Anonymous videos,” “Kirtaner is great all night”) and “Kirtaner Fridays” (Episode #42) (Mar 17, 2021, with a link to Kirtaner’s Patreon). The show restarted as a live broadcast on Nov 8, 2020 (Episode #1, “Me, Anonymous, and Occupy”), while the Signal chat in the entry above, which runs Sep–Nov 2020, was still going. Kirtaner is the guest on Episode #3 (Nov 14) and Barrett Brown on Episode #4 (Nov 17). The two Kirtaner episodes above fall while the Thinkin Project Discord was forming (chapter 24). Episode #42 went up on Mar 17, 2021, the same day VICE published its Thinkin Project article. That is a coincidence of dates and nothing more. None of the three descriptions calls Kirtaner a founder of Anonymous. My recollection is that Housh repeatedly presented him as an original Anon; I have not yet pinned that to a timestamp, so it stays my account.
The playlist. Documented Episode #77, published Aug 28, 2023, is titled “High Fidelity,” and its description lists Kyle Rittenhouse, GiveSendGo, Q, Fightback Law / Fightback Foundation and John Pierce. “HiFi” is the other person in the Kirtaner Signal chat above. On the show he gives his name as Josh Fidel (about 1:05), which fits the @jcefidel handle in that chat, and I know the guest’s own account, @highfidelity420, to be HiFi’s. Of the 66 videos the playlist “The Gregg Housh Show Live” lists (my capture of the page, Oct 21, 2026; YouTube’s API counts 69, so three are unavailable), 28 titles name Kirtaner, six name Barrett Brown and two name Joe Fionda (Episode #12 and “Joe Fionda and the Electric Boogaloo”; Fionda’s sworn affidavit is in chapter 13). Five of the first thirteen numbered episodes are Kirtaner (#3, #6, #8, #11, #13), Episode #4 is Barrett Brown, and Episode #1 is titled “Me, Anonymous, and Occupy.” The page dates Episode #1 to Nov 8, 2020 and Episode #11 to Dec 8, 2020, so Episodes #1–#10 run across those four weeks. No title names Rauhauser, Libby Shaw, Welna, Stewartson, Dilley, Hassan, Schoenberger, Defango or Q; those names enter only through what guests say, as in Episode #77. So one show hosted the man in that chat, the man who published it, and its other participant. That is a fact about a guest list, not about what anyone said on it.
HiFi in his own words. Claimed · his account In Episode #77 he says he met Jim Stewartson, who “pulls me into a chat room and there’s [Kirt]” (1:28:22). The auto-transcript spells the name “kurt”; it is Kirtaner, whom Housh also calls “kurtanner” and “Kurt” in a May 2021 episode of this show (below). At 2:37:41 he says “if you guys hate me for what I did to help Jim and [Kirt] stop Q,” and at 2:01:18 that “QAnon was a game. It was designed to put people into apophenia,” pointing to Stewartson’s Financial Times video, “Is QAnon an 8Chan Game Gone Wrong?” (mid-Oct 2020; see chapter 24 for my own Oct 16, 2020 message to the FT with Stewartson copied). At 1:56:56 he calls Thomas Schoenberger “one of the game runners of QAnon.” That is his assertion. This file does not adopt it, and it leaves out the speculation about third parties that comes with it. The episode runs close to three hours and makes many other allegations about named people; none is used here. What it documents is who was in the same story: HiFi, Stewartson and Kirtaner, on Housh’s show, in HiFi’s telling.
Housh and Fionda, May 2021. Documented The episode “Joe Fionda and the Electric Boogaloo” was recorded around May 5, 2021, going by the news the two men discuss; the transcript has no speaker labels. Housh says he has been friends with Joe “for a long time” and calls him a good researcher (34:35–35:05). At 3:38 he talks about “me and kurtanner” on Fridays, and at 58:51 about Friday “with kurt.” At 40:00 one of the two says “we know that people like [Steven Biss] and his wife have these emails with like guys like Defango and Thomas Schoenberger,” the same email channel that chapter 05 documents. The transcript garbles the first name and I have bracketed my reading of it. At 59:16 Housh mentions a tweet “from Rocco” (Rocco Castoro; I am confident it is him, and he is entry 129 on the plaintiff’s preliminary witness list in Schoenberger v. Dilley, chapter 14). At 59:57–1:00:21 he says he has not yet asked Rocco onto the show (“you guys would love Rocco”) and floats a show with Joe and Rocco once they can talk about “some subjects that we can’t talk about tonight.” I do not know what those subjects were, and no later title in the playlist names Rocco. So by May 2021 the Biss–Defango–Schoenberger emails were already being discussed on this show, by one of two people who were friends. It does not say who they got them from.
Hassan on Housh. Claimed · hearsay In an interview with Travis View of QAnon Anonymous (autumn 2020; the date is not on my copy of the transcript, and I date it from what is said in it), the cult expert Steven Hassan says he met Housh at a Scientology protest in Boston Commons. At 18:23–19:19 he says Housh told him, off camera: “I know the three guys who started QAnon. It was a total goof. They were goofing on Trump,” that they then “started to realize they could make some money by selling merchandise,” and that Housh “thought the Russians got involved.” This is Hassan relaying a private remark. Housh did not say it on the record, and I do not adopt it.
The Boston link to Rauhauser. Claimed The Other McCain (Robert Stacy McCain, Jun 17, 2012), a blog hostile to Rauhauser, says “a September 2011 e-mail from Rauhauser to leaders of the ‘Occupy Boston’ protests” shows him presenting himself as an agent of Brett Kimberlin’s Velvet Revolution group, and that “Rauhauser was acquainted with ‘Anonymous’ hacker Gregg Housh.” The post describes the email and does not reproduce it, so I treat it as a lead and not a fact. The Velvet Revolution and Occupy side of Rauhauser is the subject of this chapter.
Housh on FRANCE 24, about March 2014. Documented The transcript of the Tech24 segment below, “Hackers and Whistleblowers: Bad boys or heroes?” (FRANCE 24 English), is dated from what is said in it: House of Cards season 2, the third anniversary of the Syrian war, and “this past week” at South by Southwest. The presenter introduces him as “Greg Hausch, the man behind Anonymous” (0:25) and as “one of the few known members of Anonymous” (1:15); the transcript misspells his name. Housh says he has not “done much hacking for years” (1:15), that he consults for House of Cards on its hacker storyline (1:36–2:19), that the Church of Scientology outed him because the “Message to Scientology” video, which he “had a lot to do with putting together,” started the Anonymous actions against it (4:05–4:35), and that he wants to prove “not all hacking is bad” (5:02–5:15). Asked whether hackers are becoming Hollywood’s new heroes, he answers “I really do think hackers are going to be the new heroes in Hollywood. I think it’s a real simple story to tell and they love the simple ones” (5:41–6:03). The next guest, a tech journalist, is asked whether Assange and Snowden were the stars of South by Southwest and says “absolutely” (6:14–6:43). The line I had paraphrased as “being a hacker is being cool or a hero” is that exchange; the quote above is the exact wording. I cite it for the frame, not for anything Housh says about Kirtaner: a hacker image sold as simple and heroic is what a “founder of Anonymous” story trades on (see the HBO “Anonymous Founder” credit earlier in this chapter), and in 2014 a television network was already presenting Housh as “the man behind Anonymous.”
FRANCE 24 English · Tech24, about Mar 2014. Housh’s interview runs 1:15–6:03; the Assange and Snowden discussion follows.
Put end to end. Rauhauser and Housh acquainted in 2011 (Claimed); Housh hosting Kirtaner in Dec 2020 (Documented); Rauhauser, Schoenberger and Stockton discussing Cottle in a public exchange in this chapter (Documented); Cottle at the start of the Thinkin Project, per VICE (chapter 24); and the Kirtaner and HiFi launch chat above. Each link has its own source and tier. Stewartson, Troy, Kane and the others in that entry are one cluster of a larger one.
What this does not say. It does not say Housh, Rauhauser, Cottle or Hassan coordinated anything, that Housh knows who started Q, or that Q was a goof. Housh appears here only as a host, as the subject of Hassan’s anecdote and as a name in McCain’s post.
The broker
In September 2020, Jim Stewartson brokered the author's interview with Beran. Beran's first message says Jim mentioned the author might be a good source. Stewartson's coaching before the interview: "don't give him your vault." By Beran's own later account, the Schoenberger story reached him through Stewartson and a TEDx Mid-Atlantic organizer named Dave Documented, whom the author identifies as Dave Troy. Claimed
The misrepresentation
Days after VICE aired "Who is Q?" (January 27, 2021), Beran appeared on a QAA livestream. He said the author's evidence was screenshots of Defango videos — traceable to a single mis-pasted tweet the author corrected in writing on October 3, 2020. He attributed to the author a claim that a woman was FBIAnon, verified by feet pictures. The author's documented claim, in writing to Beran on September 6, 2020, was that FBIAnon was the Q beta and that Thomas Schoenberger orchestrated it. On air, Beran named the author and described his circumstances, while honoring another caller's request to stay on background.
The script
On February 4, 2021, QAA released Episode 128, co-written by Beran, with Fredrick Brennan as a guest. It repeats the 2015 date for Cicada 3301 (the puzzle began in 2012) and frames the Schoenberger story as Defango plus "credulous laymen." The same episode describes Anonymous as a leaderless effort in which nobody was ever in control — six months after Beran's own article printed Kirtaner as its founder. The author had corrected the Cicada date and the FBIAnon claim by DM on February 15, 2021.
The aftermath
Beran later walked the founder claim back in a tweet Claimed (link pending) By then Kirtaner was credited as "Anonymous Founder" in HBO's Q: Into the Storm, and Wikipedia still cites the Atlantic article as the source for the founder claim. Documented
What this shows
Taking down the frontman leaves the press credential, the brokers, and the people who equipped him and opened doors to journalists intact. The method described in this chapter does not require every participant to know they are part of an operation; it requires the right people pointed at the right target at the right moment. The timing here — credential, launch, amplification, and a counter-narrative against the author landing in the week of his widest exposure — is documented. Documented Central direction of that timing is not yet documented. Unverified
Timeline
| Date | Event | Tier |
|---|---|---|
| 2020-08-11 | The Atlantic publishes Dale Beran's "The Return of Anonymous"; Kirtaner (Aubrey Cottle) identified as a founder of Anonymous | Documented |
| 2020-09-06 | First DM between Beran and Arturo; Beran: Jim [Stewartson] mentioned Arturo might be a good source. Arturo states FBIAnon = Q beta, Thomas Schoenberger orchestrating | Documented |
| 2020-09 | Stewartson coaches Arturo before the Beran interview: "don't give him your vault" (Arturo's Gmail) | Documented |
| 2020-09 | "Dave" (TEDx Mid-Atlantic organizer) co-brokers the Schoenberger story to Beran with Stewartson, per Beran's own on-air account; Arturo identifies him as Dave Troy (Beran's account / identification) | Documented Claimed |
| 2020-09-18 → 2020-11-19 | Kirtaner/HiFi Signal chat preparing the "founder of Anonymous" launch, with media bookings; HiFi calls it a larp; Arturo's evidence album opened in the chat (Barrett Brown video) | Documented |
| 2020-10-03 | Beran says he can't trust Defango-sourced material; Arturo replies he pasted the wrong tweet and sends the correct one | Documented |
| 2020-10-30 04:40 UTC | Beran tweets Anonymous is back "this time with a leader (their founder)", ~4h after Kirtaner's announcement; links his Atlantic piece. Tweet still live | Documented |
| 2020-11 | Kirtaner Reddit AMA cites the Atlantic piece as the article that revealed his identity | Documented |
| 2021-01-27 | VICE "QAnon: The Search for Q" ep. 2 "Who is Q?" airs. Same day, Rauhauser (@AmericanHacker) thread credits Stewartson's "weaponized ARG" map and points readers to @RealOGAnonymous (tweets / @RealOGAnonymous = Kirtaner handle) | Documented Unverified |
| 2021-01-27 → 2021-02-02 | QAA Twitch livestream: Beran says Arturo's evidence was "screenshots of Defango videos", attributes to Arturo a "Lisa = FBIAnon / feet pictures" claim, names Arturo and his circumstances while honoring another source's background request, dates Cicada to 2015 (stream transcript; Morrison clip) | Documented |
| 2021-02-02 | Arturo DMs Beran while listening; Beran replies he spoke up because the VICE doc spread misinformation | Documented |
| 2021-02-04 | QAA Ep. 128 "From Anonymous to QAnon", co-written by Beran, guest Fredrick Brennan. Repeats Cicada "2015"; frames the Schoenberger story as Defango + "credulous laymen"; Fuxnet segment describes Anonymous as leaderless with nobody in control | Documented |
| 2021-02-15 | Arturo asks Beran where the FBIAnon "feet" claim came from and corrects the Cicada date (2012) | Documented |
| 2021 | HBO "Q: Into the Storm" credits Kirtaner as "420chan Founder, Anonymous Founder" (IMDb credit) (credit listing) | Documented |
| later | Beran walks the founder claim back in a tweet (link pending) | Claimed |
| 2026-10-03 | Arturo publishes the case study on X | Documented |
Sources · 12.x
- S1 · Grifter, "The GiveSendGo Hacker Is Weird" (YouTube) ↗ · 2022-02-17
- S2 · Barrett Brown, "Manufacturing Dissent: Leaked Preparation for Kirtaner's 2020 Launch as 'Founder of Anonymous'" (YouTube) ↗ · 2026-08-08
- S3 · Arturo, "THE LARP VS LARP INCIDENT" (X thread with clip) ↗ · 2026-09-23
- S4 · Dale Beran, "The Return of Anonymous," The Atlantic (Wayback) ↗ · 2020-08-11
- S5 · Dale Beran tweet (Anonymous returns "with a leader (their founder)") ↗ · 2020-10-30
- S6 · QAA Ep. 128, "From Anonymous to QAnon feat Dale Beran, Matt Alt, Fredrick Brennan & Fuxnet" ↗ · 2021-02-04
- S7 · Daniel Morrison, "The Troll Who Created 'Qanon'" (includes QAA stream clip/transcript) ↗ · 2021-05-23
- S8 · Arturo, X thread on Beran / The Atlantic ↗ · 2026-08-18
- S9 · Arturo, X post publishing this case study ↗ · 2026-10-03
- S10 · Rauhauser (@AmericanHacker) thread crediting Stewartson's ARG map, pointing to @RealOGAnonymous — screenshot only, held in the author's files · 2021-01-27
- S11 · Arturo ↔ Beran X DMs (export dated 2023-09-19) — screenshot only, held in the author's files · 2020-09-06, 2020-10-03, 2021-02-02, 2021-02-15
- S12 · Stewartson coaching email ("don't give him your vault") — screenshot only, held in the author's files · 2020-09
