The QAnon Timeline: Four Years, 5,000 Drops and Countless Failed Prophecies

- QAnon

- Tech Team

Translations: Русский

QAnon is not a static conspiracy theory. Since it first emerged in 2017, it has continuously evolved, focusing on different key topics and adopting elements of other conspiracy theories. As Bellingcat has recently written, this elasticity has been the key to its success.

With the inauguration of US President Joe Biden, QAnon’s faithful are adrift and confused. Their distress has caused some observers to ask whether their cult may collapse entirely. That might be premature. Failed prophecies do not always collapse elaborate conspiracies — if that were true, how could QAnon have endured for four years?

If we cannot predict its end, we can at least trace QAnon from its beginning — looking at all the falsehoods and conspiracies it peddled, from the initial Mueller investigations to the era of COVID-19 and the last days of the Donald Trump presidency.

Supporters wearing shirts with the QAnon logo, chat before U.S. President Donald Trump takes the stage during his Make America Great Again rally in Wilkes-Barre, Pennsylvania, USA, August 2, 2018. Photo (c): Reuters / Leah Millis

Bellingcat researchers have analysed a dataset containing 4,952 so-called “Q drops”, the cryptic messages that are at the heart of the conspiracy theory. These were posted by an anonymous person known simply as “Q” — whom followers believe to be a source of insider knowledge about US politics. Whenever a Q drop appears, believers around the world eagerly try to interpret its hidden meaning,  connecting them to real world events.

The Q drop dataset was found on the image board 8kun, which was used by Q followers as a location to comment on Q drops. It contains posts dating back to October 2017, a time when QAnon theories were a fringe online hobby, and continues until October 2020 — by which time they were taken all too seriously.

The word clouds in the timeline show the most common words found in the Q drops over one- or three-month intervals, while the accompanying text discusses important developments during these periods, both in US politics and significant Q drops.

This chronology brings quantitative and qualitative analysis to the story of QAnon’s growth, enriching our understanding of how the conspiracy adapts to contradictions and evolves its narratives.

This investigation illustrates key developments and discussions in the QAnon conspiracy theory over time. To identify these trends, we split the data into subsets of one to three month intervals with an average of 290 Q drops.

For each subset, we ran a clustering algorithm that grouped sentences with a similar sentiment together. Using the results of the clustering, we then summarised major topics and notable developments for each time period.

“Sentiment” was evaluated using the Universal Sentence Encoder, an academically recognised text classification model that converted each Q drop into an array of numbers — a vector — based on its meaning.

Q drops with similar meanings have similar vectors. The closeness of two vectors can be calculated by taking their dot product. Thus we were able to evaluate the “closeness” in sentiment between sentences in order to categorise the text of each Q drop.

Pre-QAnon (2016)

Something of a precursor to QAnon can be found in Pizzagate — the false theory that Hillary Clinton operated a child sex-trafficking ring out of the basement of a pizza restaurant. Pizzagate, too, inspired serious followers who vowed to take action. One was Edgar Maddison Welch from North Carolina, who was arrested on December 4, 2016 for firing an assault rifle at the Washington D.C. pizza restaurant which was alleged to be the location of the crimes.

Welch’s arrest helped to debunk the conspiracy. But from the ashes of Pizzagate emerged QAnon. This new conspiracy theory replaced the Achilles’ heel of Pizzagate — its specificity — with ambiguity and adaptability. FBIAnon, a self-described high-level government analyst who was ostensibly the central source of information in the Pizzagate conspiracy, was replaced with Q, a supposed high-ranking intelligence officer with classified information on a supposed global cabal. As QAnon became an umbrella conspiracy theory, many others collected under its shade. Pizzagate lived on, in another form.

The first documented Q drop appeared on October 28, 2017 under the /pol/ sub board of 4chan, the “politically incorrect” and anonymous image board notorious for its grotesque content and memes.

October 2017

17 Q drops

This month’s drops all appeared over a four day period. These drops were attributed to Q through their tripcode, a unique identifier on 4chan that proves a series of anonymous posts were written by the same person or people.

From the first two words of the drop (“HRC extradition”), it is clear that QAnon was recycling an idea from Pizzagate — that Hillary Clinton was a member of child sex trafficking cabal. The next seventeen drops established Donald Trump’s role in the theory, as the central hero bent on exposing the cabal, and introduced “Operation Mockingbird,” an alleged plot by mainstream media to hide the global elites’ Satanic crimes through fake news.

Notably, many of the initial Q drops are phrased as a series of questions, generating engagement and participation from followers of the conspiracy theory.

The most-mentioned topics in these drops were Hillary Clinton, POTUS (Donald Trump), the aforementioned “Operation Mockingbird”, the philanthropist George Soros, and Huma (Huma Mahmood Abedin, former deputy chief of staff to Hillary Clinton).

November 2017

223 Q drops

The following month, Q’s activity surged. The majority of these drops expanded upon previous theories about Hillary Clinton, adding to the cast of characters with conspiracy theories involving Huma (Clinton’s political aid during the 2016 campaign), Barack Obama, Iran, and Saudi Arabia.

“Antifa,” a term which has since become widespread in American politics, appeared in a Q drop on October 30, 2017. This was Q’s first use of the term.

On November 4, Q first uses the millenarian term “the great awakening” — when the supposed cabal will be toppled and justice restored. It will become one of the conspiracy’s most recognisable slogans.

Furthermore, “Alice and Wonderland,” code for “Hillary Clinton and Saudi Arabia,” began to appear in Q drops. This links to a conspiracy which alleged that Barack Obama and Hillary Clinton were beholden to Saudi interests, in particular Prince Al-Waleed bin Talal, a Saudi prince and businessman to whom both owed money. Another emerging conspiracy theory alleged that the Obama administration had secretly assisted the governments of Iran and North Korea to develop their nuclear weapons programs.

Once again, Huma and Hillary Clinton were the most mentioned subjects in these drops, followed by Saudi Arabia, Barack Obama, Al-Waleed Bin Talal, nuclear weapons, Iran, North Korea, Speaker of the House of Representatives Nancy Pelosi and former National Security Advisor Michael Flynn.

December 2017

219 Q drops

At the end of 2017, John McCain took his place alongside Hillary Clinton and Barack Obama in QAnon’s cast of villains. Some of the month’s Q drops alleged that he had connections to terrorist groups, the Free Syrian Army, and Saudi Arabia.

The QAnon community was excited by the possibility of further external validation — a government press release entitled “United States Sanctions Human Rights Abusers and Bad Actors Across the Globe” was believed to be authored by Q.

The same month, it became known from the press that Barack Obama — whom QAnon believers referred to by his middle name Hussein — had taken the secret service code name “renegade”. For followers of the conspiracy this was appropriate, as they increasingly accused the former president of betraying the US.

But alongside its focus on supposedly corrupt individuals, the conspiracy began to evolve to target entire organisations. This month saw several attacks on the Red Cross, whose offices in Haiti are believed by QAnon followers to be a hotspot for child trafficking.

January 2018

200 Q drops

This month, the QAnon community asserted that Donald Trump had surreptitiously addressed them via Twitter. The “evidence” for this was supposedly that Trump had misspelled a Tweet, correcting the word “consentual” to “consequential”. The 8kun imageboard brimmed with discussions about the added letter “q”.  A later Q drop then affirmed the community’s connection to Trump.

Following claims that the original 4chan board had been infiltrated, the QAnon community then migrated to 8chan, another imageboard. Q attempted to re-establish their authority during this move, confirming a tripcode on the new platform. However, suspicions arose regarding Q’s identity.

The whistleblower Edward Snowden, whose initial role in the theory is controversial, is accused by Q of being a CIA plant in the NSA, with the CIA allegedly a tool of the corrupt cabal.

Meanwhile in the outside world, the US government entered a 35-day shutdown, while Special Counsel Robert Mueller led an investigation into possible collusion between Russia and the Trump campaign during the 2016 presidential election. Both issues affect the topics of Q drops.

This month, Q coins the slogan “Where we go one, we go all”. It will become a major rallying cry for followers of the QAnon conspiracy.

Perhaps unsurprisingly, Robert Mueller and his activities were a key topic in the month’s Q drops.  Fake news, Russia, and Attorney General Rod Rosenstein also featured prominently.

February to March 2018

323 Q drops

This period saw Q’s first mention of the name “Operation Merlin”, referring to the aforementioned plot by the Obama administration to send technology to Iran and North Korea. Here, Q alleged that as part of the operation, the US authorities also sent flights carrying billions of dollars in payoffs to puppets of a shadowy global cabal.

Q also declared that cell towers, phones and Amazon Alexa and Google Home smart speakers are capable of “voice to skull” technology, emitting frequencies which implant thoughts and compel people nearby to take certain actions. Blackberry, Q continued, was destroyed by the “global cabal” for not complying with these goals.

Edward Snowden also re-emerged as a central figure of interest in Q’s lore. Q claims that the CIA uses computer games to send coded orders for illegal operations to rogue operatives such as Snowden and John Perry Barlow.

Big tech companies (namely Facebook, Twitter, Amazon and Google) take the spotlight in this period’s Q drops, followed by Edward Snowden, the CIA, and the question of Russian interference on US politics.

April to May 2018

450 Q drops

Q continued to focus on “deep state” collusion with foreign powers, claiming that these shadowy powers had mined uranium in Syria to sell to Iran, covering up the deals by blaming the Russians. As the nuclear deal with Iran came to an end, Q drops considered whether Iran was continuing work on a nuclear facility in northern Syria.

Amid continuing discussions on race and racism in the USA, Q made an appeal to Black voters, increasingly stating that Black communities were ideologically enslaved by the Democratic Party.

On April 3, Q first uses WWG1WGA, the acronym for the slogan “Where we go one, we go all”. Much like the phrase itself, it will become common among QAnon followers.

Q’s tripcode password was leaked, allowing several QAnon followers to post from the account. A new tripcode for Q was then whitelisted and accepted by followers.

Alongside their focus on Syria and uranium deals during this period, Q drops started to draw attention to the convicted sex offender Jeffrey Epstein.

June to July 2018

352 Q drops

On June 16, Q released a “hit list” of 101 reporters who allegedly “colluded with the DNC [Democratic National Committee] during the 2016 election”. Q drops later accused the British government of having worked with Barack Obama in order to sabotage the same election.

Following Epstein’s arrest on July 6, Q drops discussed the sex trafficking crimes which Q insisted continued to be committed by the cabal. Several drops attempted to connect Bill and Hillary Clinton to Epstein, as well as other traffickers such as Allison Mack.

Q zealously followed discussions around the possible impeachment of Donald Trump and the activities of Special Counsel Robert Mueller. Key topics of interest in all Q drops over this period were fake news and “MSM”, the UK and London, and sex trafficking.

August to September 2018

517 Q drops

This period appeared to be a major call to action to QAnon followers. Many of the Q drops focused on awakening from the “fake news media” with the urge to be “sheep no more” and spark a “grand awakening”.

Q drops struck a strongly political tone in August and September, repeatedly encouraging followers to vote in the US midterm elections in order to secure a “red October” (meaning a Republican landslide).

The controversy over the confirmation of Brett Kavanaugh as an Associate Justice of the US Supreme Court was denounced by Q as an example of “liberal left lunacy”. Q also accused bot accounts and hired trolls of downvoting QAnon-related posts on discussion boards.

The “red October”, Kavanaugh confirmation, “fake news”, and allegations of Twitter censorship were all leading topics in Q drops over this period.

October to December 2018

341 Q drops

As the US held midterm elections, online allegations of electoral fraud foreshadowed the same approach the Trump campaign would take in the 2020 presidential election. QAnon conspiracy theorists accused the Democratic Party of filling out “blank ballots” or destroying legal ones, and organising non-citizen voting.

Here Q coined the term “Scaramucci play”, referring to a theory that the White House Director of Communications Anthony Scaramucci had been hired temporarily to remove “untrustworthy staffers” such as the White House’s Press Secretary Sean Spicer and Chief of Staff Reince Priebus.

Electoral fraud was the most mentioned topic in Q drops throughout this period, alongside alleged corruption in the Democratic Party and Department of Justice. Q also paid particular attention to the Senate Judiciary Committee’s hearings on the nomination of Brett Kavanaugh.

January – March 2019

668 Q drops

After Trump’s unsubstantiated claims that Obama had wiretapped his election campaign in 2016, Q raised the alarm about “spygate” and accused Obama once again of betraying the USA. In September 2019, the Justice Department would confirm that neither it nor the FBI had any evidence that Trump Tower had been the target of surveillance efforts by the Obama administration.

During this period, one of Q’s most lurid claims surfaced — namely that Ruth Bader Ginsburg (referred to in Q drops as “RBG”) was a member of the occult due to her association with the Clintons (Bader Ginsburg was nominated as an Associate Justice to the Supreme Court by Bill Clinton in 1993).

The White House was plunged into chaos after Trump dismissed FBI Director James Comey on May 9. Responding to these events, Q accused Rod Rosenstein of secretly recording Trump in the White House with a view to “entrap” the president. Q then questioned Rosenstein’s connections with the Democratic Party and the “extreme left”.

Key topics of Q’s interest in this period included the Mueller trials, Edward Snowden and Ruth Bader Ginsburg.

April to June 2019

42 Q drops

The Mueller report into Russian interference in the 2016 presidential election was published in April. Until its release, the report into Russian interference in the 2016 presidential election was interpreted by some QAnon believers as part of an attempt to expose the supposed global cabal. Once again, they were disappointed — so Q muddied the waters.

With the report made public, Q suggests that it was not the endgame in the struggle against this cabal, but the beginning of yet another. This heralds the reappearance of DECLAS — a term Q had first used in November 2017 to refer to an undetermined future point where documents exposing the truth about the cabal will all be declassified.

July – August 1 2019

218 Q drops

Q finds another target: Planned Parenthood. Q’s drops claim that the organisation, which offers access to abortion in the USA, is a conspiracy “having nothing to do with a woman’s right to choose,” whose purpose is to harvest fetuses for profit.

Meanwhile Trump continued to denounce Obama, claiming that he had attempted to call Kim Jong-Un multiple times to “beg” for a meeting, but the North Korean leader did not respond. In doing so, the president compared his predecessor’s record with his own supposed success — Trump met Kim Jong-Un at a summit in Hanoi in February.

A Q drop from this period suggests a similar fixation on the supposed failings of Trump’s predecessor, with the words “Would you believe Hussein tried to call Kim prior to the Summit? He did not have his updated phone number.”

Key topics of interest in Q drops for this period include the investigation into Russian interference, child trafficking and Jeffrey Epstein.

August 2 – November 10 2019

No Q drops

After three shootings in August 2019 in which the attackers used 8chan to spread their hateful manifestos, the website was taken offline that same month. No Q drops appeared during this time period until a transition was facilitated to 8kun, a rebranded version of the site which was launched in November.

November 11 – December 2019

204 Q drops

Q’s interest in “spygate” returned. “Never has a president left office to collude with others to impede the next sitting president of the United States of America until Obama!” declared one Q drop.

Discussions about Jeffrey Epstein and child trafficking grew in prominence.

Key topics throughout this period included spygate, fake news, attempts to impeach Trump, and Antifa.

January – April 2020

265 Q drops

The first case of COVID-19 was confirmed in the USA on January 20; Trump declared a public health emergency on January 31.

In March, Trump misinformed the public that hydroxychloroquine could be effective in treating or preventing COVID-19. Q followed suit and implied that the medication, which is used to prevent malaria, can also be a cure for the new coronavirus. “What if a cure already exists?” asked Q in one drop, before suggesting that the Democrats are attempting to suppress it.

Q also perpetuated accusations that Democratic governors forced infected COVID-19 patients into nursing homes, thereby deliberately causing the majority of the country’s COVID-19 deaths at the time. Perhaps surprisingly, Q’s first mention of the term “COVID-19” only appeared on April 8.

Key topics in this period were the COVID-19 pandemic and Attorney General William Barr. As a staunch supporter of Trump, Barr defended the president’s decision in April to fire Michael Atkinson, Inspector General of the US Intelligence Community.

The phrase WWG1WGA frequently appeared in Q drops during this period.

May – July 2020

581 Q drops

As the USA looked toward the November presidential election, Trump supporters continued to peddle conspiracies about the Democratic Party preparing for massive voter fraud. Accordingly, QAnon followers and Q drops alike relayed the same messages.

Q drops then refocused on Epstein. One of them included a photo of Ghislaine Maxwell, the British socialite who was arrested on July 2 for her complicity in Epstein’s crimes. Multiple Q drops included photos of Bill Clinton alongside Jeffrey Epstein, followed by more familiar conspiracy theories about the Clintons operating a child trafficking ring.

Subsequent drops accused all five presidents before Trump of colluding with the “deep state”, then turned their attention to Trump’s Democratic challenger Joe Biden. Q also shared thoughts about the protests which rocked the country following the killing of George Floyd by Minneapolis police. Q focused commentary on Antifa’s presumed role in the demonstrations, even quoting and reposting Fox News articles describing Antifa as an “anarchist, left-wing outlet”.

Key topics mentioned during this period included mail voting, election fraud, Ghislaine Maxwell, the Clintons, and the COVID-19 pandemic.

August – September 2020

179 Q drops

The Republican and Democratic Parties both held their national conventions in August, during which Trump and Biden were chosen as their respective presidential candidates. On August 20, Trump was asked his opinion of the QAnon movement during a press conference. The president stated that he knew little about the conspiracy theory but acknowledged that “they like me very much”.

Amid growing polarisation about the upcoming presidential election, Q continued to fulminate against Antifa, comparing it to the militant anti-fascists of the interwar German communist party. Q drops also compared Democrats’ usage of social media to the propaganda of Nazi Germany. The fractious atmosphere before the election also lead to more media attention towards QAnon — to which both Q and followers reacted very negatively.

Key topics in this period included Antifa, child trafficking and sex criminals, and the word “MSDNC”. The latter, a portmanteau of the cable TV channel MSNBC and the acronym for the Democratic National Committee, was used in Q drops denouncing fake news.

October 2020

148 Q drops

After it had generated rising media coverage and notoriety, Trump was asked if he would denounce QAnon during an interview with the NBC’s Savannah Guthrie. Trump reacted defensively and refused to explicitly disavow the conspiracy, saying “I don’t know about QAnon”.

In a single month, Q shared over 30 articles about Hunter Biden from right-wing news outlets such as Fox News and Breitbart. Since 2019, Hunter had been accused by Trump and his supporters of corruption due to his business dealings in Ukraine while his father Joe Biden was Vice President.

Otherwise, this may have been a month of déjà vu for Q’s followers. Drops earlier in the month refocused on the Clinton Foundation, accusing the Clintons of bribing politicians in Washington D.C. With another election around the corner, Q came full circle to the conspiracy’s first fixation:

Q’s penultimate drop in October read simply “are you ready to take back control of this Country”, implying that the election was not merely a referendum against the Democrats, but against a global cabal of bad actors which still reigned:

Key topics of Q drops during this period included Joe Biden, Hunter Biden, and the Democratic Party.

What next?

Since the US election in November 2020, the rate of Q drops has sharply declined. Only a single drop appeared in the last two months of 2020, on December 8. Recent crackdowns on QAnon accounts across social media, and the inauguration of President Joe Biden, have dealt further blows to the conspiracy.

At the time of publication, there have been no confirmed Q drops in 2021. But it’s far too early to catalogue the conspiracy as history. As demonstrated repeatedly in our timeline, QAnon is extremely adept at adapting to contradictions and challenges.

The conspiracy has weathered both homelessness on the internet (the 8chan shutdown and 4chan migration) and longer freezes in Q drops (101 days from August to November 2019) before.

It may yet survive.

Acknowledgements

Special thanks to William Thompson, and Johanna Wild and Logan Williams from the Bellingcat Tech Team for their assistance on this investigation.

Where in the World is Q? Clues from Image Metadata

- 8chan

- QAnon

Translations: Русский

The hunt to identify the person or group behind the QAnon conspiracy theory continues. Known only as “Q,” this individual or collective is responsible for the many posts, or “drops,” that appeared on internet imageboards between October 2017 and December 2020.

It has not been an easy search. But a fresh approach has yielded more clues. Image metadata comprises many different kinds of information, some of which can speak to the origin of the image itself and, by extension, who created it. Since many of Q’s posts come with an image attached, examining image metadata can provide clues as to where Q has been — and when.

We examined metadata found on images associated with 27 Q drops. We infer from the metadata that the images are screenshots taken in two time zones: UTC+8 and the Pacific time zone. UTC+8 is a time zone including the Philippines, China, Mongolia, Taiwan, Malaysia, Brunei, and parts of Indonesia, Russia and Australia. Pacific time includes the West coasts of Canada and the USA, Nevada, part of Idaho, and part of the northwest coast of Mexico.

The vast majority of these images, ranging in date from November 7, 2017 to September 23, 2020, appear to originate from the Pacific time zone, while a handful of remaining images from February 2018 and 2019 appear to originate from UTC+8.

Timezone map from Wikimedia Commons, with UTC+8 highlighted in yellow by Robert Amour

If accurate, the UTC+8 cluster of images could suggest that Q is a single individual who lives in the Pacific time zone but has traveled extensively in Asia (with stops at least in Hong Kong, Chongqing, Shanghai, and Bangkok, based on the contents of Q’s photos).

What is QAnon?

QAnon is a baseless conspiracy theory that flourished on the internet during the Trump era. Members of the online movement followed an anonymous poster, Q, who outlined Trump’s supposed plan to take down a global cabal of child-sacrificing elites. Claiming a high-level security clearance in the Trump administration, Q promised a bloody revenge on enemies like Hillary Clinton, Barack Obama, and George Soros. QAnon has drawn in new adherents during the COVID-19 pandemic, and radicalized members of the movement participated in the storming of the Capitol on January 6, 2021.

Those outside the movement dismissed Q’s declared identity as fantastical, and over time journalists assembled a list of figures who might be behind the account in reality. Vice News has argued that early Q drops were authored by a hacker collective and perhaps followed up by a right-wing operative. The new HBO Documentary, “Q: Into the Storm,” addresses suspicions about the previously speculated involvement of Ron Watkins and his father Jim, who were respectively the manager and owner of the website 8chan (and its successor 8kun), which was the exclusive platform of Q for all but the first month of Q’s existence.

The Dataset

We have made our code and results available in a Github repository, and hope other researchers will build on our findings.

We downloaded 1,720 image files from https://qalerts.net/media/. We also downloaded the JSON file of the text of the Q drops and their basic non-image metadata from https://qalerts.app/data/json/posts.json.

The collection of image files includes both images Q themselves posted and images in posts that Q replied to. Using the information in posts.json, we removed all images posted by anonymous users (“anons”) who were not Q. This results in a dataset of 1,087 images.

We then ran the “exiftool” program to extract image metadata from every image and collated the information into a spreadsheet. This CSV spreadsheet file contains one row per image and 275 columns. Not all columns are populated for each row, since individual images do not typically include every possible kind of metadata.

We spot-checked these photos in their original settings, i.e. on 8chan/8kun as well as 4plebs (a popular 4chan archive) to ensure that the image metadata was present in the original and not an artifact of qalerts.net’s collection process. We found that the metadata was indeed present in the original files. We also uploaded a few sample images to the existing 8kun website, and downloaded them again after they were posted. This allowed us to ascertain that the version of the 8kun website now running neither strips nor adds metadata to images stored on it.

Returning to our 1,087 images, we first checked to see which metadata fields were populated with interesting information, and followed up by reverse image-searching those which contained interesting or identifying information. This could have linked Q’s images to other individuals, broadening the scope of possible candidates.

It also weeded out images which Q had downloaded from elsewhere which were then uploaded alongside their drops.

Indeed, some images that looked promising turned out to have been taken from other websites with metadata intact. For instance, the image of a field that appears on drop 3985 was taken from the website of Brownfield News, a media network which covers agriculture in the US Midwest.

Image from Brownfield News, taken from a drop posted by Q.

By examining the metadata on the image taken from the Brownfield News website and matching it to the image downloaded from qalerts, we ascertained that all image metadata was inherited from its origin. That is to say, all of the metadata on the image posted to 8kun was also present on the image that was part of the earlier article. It seems like Q downloaded a copy of the image from the Brownfield News website and uploaded that copy to 8kun without altering any of the metadata.

But what about images from Q drops which appeared nowhere else online?

These seemingly original images proved to be the most interesting subset of all. Several of these images not only could not be matched easily to an online origin (so may be hypothesized to come directly from Q) but also contained enough metadata to analyze.

In particular, we soon zeroed in on a group consisting of 29 images whose UserComment fields all contain the word “Screenshot.” Not only are they marked as screenshots, all of these photos appear to be screenshots taken from within a mobile device’s photo gallery. Black bars can be seen above and below most of the photos, as well as elements such as the horizontal, elliptical bar at the bottom of the photo in drop 3642—clearly a user interface element.

Q drop 3,642

However, the strongest proof that these are screenshots comes from one of the images themselves: drop 4752 contains a screenshot, not merely of a picture Q has selected from within an iPhone’s image gallery and then photographed, but of the gallery itself. This is immediately recognizable to any iPhone user.

Q drop 4,752

Of the 29 photos labeled as screenshots, 27 also contain timestamp information in the field DateCreated. These 27 timestamped screenshots appeared in 29 Q drops (two images each appeared twice).

We calculated the time difference between the timestamp of the image metadata and the timestamp in UTC of the Q drop on the imageboard itself, and used this figure to make inferences about the time zone of Q.

Inferring Q’s Time Zone

The timestamp metadata associated with these images does not include a time zone. However, the time zone of the poster, expressed as a UTC offset, may still be inferred. To infer the time zone, we use the equation:

Local time of screenshot + time to post + UTC offset of screenshot maker = UTC time of post

or

Time to post + UTC offset of screenshot maker = UTC time of post − Local time of screenshot

or

Time to post + UTC offset of screenshot maker = calculated time diff

We know the right side of the equation and need the variables on the left. We assume that Q took a screenshot of a photo and then, minutes rather than hours later, a drop was made containing that image. For instance, the image in drop 125 was created at 15:39 local time (recorded by the device taking the screenshot) on July 7, 2017, and posted on 4chan at 15:43 Pacific time (UTC time 23:43). It’s not certain that only four minutes elapsed between the time the picture was processed and posted (rather than some number of hours plus four minutes), but it seems reasonable to assume.

Furthermore, we know that UTC offsets are constrained; the vast majority of them occur in hourly increments. For instance there is no such thing as a time zone that is one hour and 27 minutes past UTC. Therefore, the assumption that time to post was under an hour fixes the UTC offset for all 27 images.

Infographic by Robert Amour and Abigail W. Xavier

Examining the clusters near UTC−7 and UTC−8, we find that they correlate with changes enforced by Daylight Savings in the Pacific time zone. Pacific time changes from UTC−8 to UTC−7 and back over the course of a year. We believe these visually evident clusters provide strong evidence that images in Q drops are sourced from two time zones, UTC+8 and the Pacific time zone.

Further Evidence for Time to Post

The data indicates that Q either waited for a handful of minutes after taking each screenshot before posting it, or that Q routinely waited for an unknown number of hours plus only a handful of minutes—which would be much more unusual behavior than simply posting right away.

In the case of drop 4752, we can verify that DateCreated is the local device time. Drop 4752 is in our Pacific time cluster, and the image in it includes the iPhone’s clock (which shows 12:07 at the time of the screenshot); our metadata also shows a creation time of 12:07. Q posted it at 12:13 Pacific time.

In general we see the same pattern for all Q drops with an image in the UTC−7 / UTC−8 cluster: for instance, drop 1206 has a screenshot taken at 18:16 local time on April 20, 2018 and posted at what corresponds to 18:18 Pacific time, while drop 1752 includes a screenshot made at 11:09 local time, which Q posted at 11:13 Pacific time.

A similar pattern holds for the UTC+8 cluster. Drop 682 contains a screenshot whose DateCreated metadata indicates that it was created at 8:38 local time. It was posted at 8:40 UTC+8 time. Similarly, drops 683–686 include screenshots containing a DateCreated value of 9:25 and 9:26 on August 2, 2018. They were posted between 9:35:08 and 9:36:59 UTC+8 time, a difference of 10 minutes. Finally, drop 2708 contains two photos that were taken at 18:27 and 18:28 local time, and posted at 18:31 UTC+8 time.

To bolster our confidence that time-to-post was within the hour and the remaining hour difference represents the device time zone’s UTC offset, we can observe the distribution of the time differences between the image’s creation date and the drop timestamp by minute within the hour. If the time to post were an hour or more on average, we’d expect to see a somewhat even distribution of minutes within the hour difference.

Infographic by Robert Amour and Abigail W. Xavier

However, the overwhelming majority of images appear to have been posted within 10 minutes, and none appear to have waited more than half an hour before being posted. This allows us to reasonably establish a pattern of behavior and to conclude that the time to post was within the hour, and that remaining hours of the difference represent the UTC offset of the device’s timezone.

Views from a Hotel Window

We know that Q, or an associate close enough to provide them with these photos, traveled to several locations in Asia — a fact which can be inferred not only from the context of these images, but their content. Several are photos of city skylines, others are close-up views of side streets. They generally do not include obvious tourist sites or any close-up individuals whatsoever — par for the course for Q, whose followers pore over images for arcane clues and metaphors.

For example, in drop 682, posted on February 8, 2018 (by UTC time), Q provided the following image of a modern skyscraper with a distinctive spire. (The black bars above and below the photo have been cropped in all images in this section.)

Q later posted one close-up photo of the awning over the building’s main entrance and another of the car park in front of it. These offered some small clues; cars bear blue license plates and a construction site to the right of the building features several bright red placards featuring Chinese characters. The words “Bank of China” can be seen on white backing on the building to the right.

Q drop 682

All of these details suggest that the tower is in the People’s Republic of China — but where? By cropping the distinctive tip of the building and uploading the image into Yandex’s reverse image search, we soon find a match: the King Tower in Pudong, Shanghai.

It is fair to assume that the photo was taken from a tall building across the New Jinqiao Road to the South-West. According to the popular Chinese mapping website and search engine Baidu, this building is the Shanghai Marriott Hotel Pudong East (上海金桥红枫万豪酒店).

Screenshot from Baidu Maps

Two days later, on 10 February 2018, Q posted a close-up image of a large letter “E” hanging from a ceiling with distinctive alternating wooden slats.

Q drop 707

In the bottom of the image, another item of a similar size and color can be seen hanging from the same ceiling. This leads us to assume that the letter “E” is one of a series in a zoning area — such as those found in airports. A simple Google search of airport arrival hallways in large cities in UTC+8 yields a result. An image from Shutterstock shows the same “E” hanging from the same ceiling at Shanghai’s Pudong airport:

Screenshot of Shutterstock’s website

Q’s next drop contained a photo from central Bangkok — Q may have meant to suggest that members of the “Q Team” had recently flown between Shanghai Pudong airport and the Thai capital.

The image below, posted in drop 708 on February 10, 2018, shows a city skyline. A building with the words “Assumption College” can be seen in the foreground.

Q drop 708

The distinctive “pixelated” skyscraper in the background is the Maha Nakhon tower in the central business district of Bangkok. When completed in 2016, it was the tallest building in the Thai capital.

This photo appears to have been taken from a floor about midway up in a hotel called The Peninsula Bangkok or from a building on the same block with a similar vantage point, such as the River Condominiums or Light House Plaza.

The riverside campus of Assumption College is almost perfectly in line with The Peninsula Bangkok and Maha Nakhon. A user-uploaded photo on Google, taken from The Peninsula in March 2021, shows Assumption College and the Maha Nakhon tower from a similar, though higher, perspective to Q’s.

Image from Google Maps / The Peninsula Bangkok

On March 7, 2018 in drop 869, Q posted an image of a bustling market street in an East Asian country with a reference to Edward Snowden in the accompanying text. In the bottom right-hand corner above a meat stall, and on several banners in the center of the image, Chinese characters can be seen but are not completely legible. Bearing in mind that Snowden first fled to Hong Kong, it’s as good a place to start as any.

Q drop 869

The architecture and commercial profile of the area matches the narrow streets of Mong Kok, a popular shopping district in Hong Kong. A digital trawl through Mong Kok using Baidu’s streetview system shows a match at the crossroads of Nelson Street and Canton Street.

Image from Baidu street view

Importantly, Q’s image shows this intersection from high above, though not from a bird’s eye view. This suggests that the photographer was standing in a tall building to the east. The most obvious candidate is the nearby Cordis Hotel.

Images posted by guests of the hotel and tagged at the location can confirm this match further. In December 2020, one visitor to the Cordis posted a panorama photo of the Mong Kok skyline; the bottom left shows this same intersection in detail.

Image: Google Maps / Cordis Hotel

Nevertheless, it should be noted that the screenshot of Q’s image from the Cordis Hotel was created by a user in the Pacific time zone, from which it can be inferred either that Q did not post all images “live” (and might have selected it from their own old photos), or that Q was posting images they had received from a contact.

On February 14, 2019, Q posted Drop 2706, which included a photo of a shopping street somewhere in a Chinese-speaking country. Unlike the previous two images, which each contain a famous skyscraper, this image was unremarkable. However, as a close-up image it did show several names of businesses such as 朋泉聚，周师兄 (Old Brother Zhou)，中国民生银行 (China Minsheng Bank), as well as 诗丽堂美容SPA (Shilitang Beauty SPA, also known by its English name Silktone SPA). Two of these are business names concentrated in Chongqing, a city in South-West China.

Q drop 2,706

As it offers a highly detailed business registry for China, Baidu Maps is the ideal source to start searching. It also offers an extensive streetview mode which allows users to compare imagery taken in different years. After checking street view imagery for various addresses for Silktone Beauty SPA branches in Chongqing, we have a match on the city’s Beijeng Tiangje Street (北城天街). It shows the same shopfront, the same names of all businesses, the same covered bus shelter, and the same distinctive streetlights:

Image: Baidu Maps

Q’s photo of the entrance was taken from above, from a building across the road to the North-East. Baidu’s map shows a highly likely candidate: the Chongqing Fuli Hyatt Regency Hotel.

Further corroborating this is another image Q posted in the same drop, showing the lights of buildings and a distant cityscape at night. Blurring suggests that this was taken at speed, presumably from an aircraft.

Q drop 2,706

The layout of the roads and buildings matches those to the right of Chongqing Airport’s eastern runway, approaching from the South.

Image: Google Maps

Importantly, drop 2503 from November 2018 includes a photo from the hotel, including a Christmas tree. That same month, in drop 2516, Q congratulated “anons” for successfully geolocating the “last pic” to Chongqing, urging them to “watch the news”.

If these images are, as they appear to be, original, then we know the location of the photographer, and can infer the location of the person who took the screenshot, but not necessarily that of the person who posted the respective drops: it is at least conceivable that whoever took the screenshots might have texted or emailed these photos to a third party, who posted them shortly afterwards.

Nevertheless, the images do teach us a few new things about Q.

We know that Q, or a very close associate, flew to Shanghai Pudong Airport prior to February 8, 2018; that they stayed at The Peninsula hotel in Bangkok prior to or on February 10, 2018; that they stayed at the Cordis Hotel in Hong Kong prior to or on March 7, 2018; that they stayed at the Chongqing Fuli Hyatt prior to or on February 14, 2019 and flew into Chongqing prior to that same date.

We know that Q, or an associate who regularly provides images for Q to post, has a particular taste in hotels and has spent time traveling, but likely not living, in four cities in Thailand and China. The fact that some of the images in China can also be geolocated to the same timezone makes the assumption about Q’s location, or the location of somebody working with Q, more plausible.

One Step Closer?

The overwhelming majority of the images in our data set — over 68 percent — appear to have been created by a user, or users who were in the Pacific time zone. Q’s content appears to have been posted from the Pacific time zone at least as early as November 7, 2017 and at least as late as September 23, 2020; this covers almost the entire period that Q was active.

By contrast, images from UTC+8 exist on only three dates in our data: February 8, 2018, February 10, 2018, and February 14, 2019.

This has several potential implications for Q’s identity.

First, these findings are consistent with the hypothesis that the same person has been posting as Q all along. In that case, Q would live or spend the vast majority of their time in the Pacific time zone, with occasional international travel. The hypothesis of a Pacific Q coheres with other quantitative work on the overall hourly patterns of the Q drops, while the hypothesis of a single Q matches the observed fact that Q had access to the same set of photos in November 2017 and May 2018.

Second, the most popular hypothesis among Q-watchers — that authorship of the drops changed hands between January 4 and January 6 of 2018 — cannot be excluded on the basis of our findings. Under this hypothesis, our evidence requires new Q and original Q both to post from Pacific Time.

That’s not impossible, of course. There are well over 50 million people living in the Pacific time zone; one of them could easily have stepped into the original Q’s place.

We reached out to Jim Watkins, the owner of 8chan/8kun who has lived in the Philippines, to comment on the implications of narrowing down Q’s timezone. In an emailed response crowdsourced via his Gab account, Watkins cast doubt on the methodology of the research and its usefulness, adding that more than a billion people live in the UTC+8 time zone. Watkins has previously denied in comments to Bellingcat that he is Q.

Bellingcat was unable to reach Ron Watkins, who has lived in Japan, for comment. Ron Watkins has also denied that he is Q in the course of the recent HBO documentary series.

It is important to stress our evidence is not by itself sufficient to identify any particular individual as Q or an associate of Q.

However, our evidence should provide a valuable datapoint for other investigators who seek to do so. The hunt for Q goes on — and these findings suggest that it must largely continue in the Pacific time zone.

Gavin Fox (pseudonym) contributed to this research. The authors would like to thank Bellingcat’s Giancarlo Forella and Maxim Edwards for their assistance in geolocating the images from East Asia.