We originally published this post at Bellingcat, and are reproducing it here by permission (archived version here).
The authors wish to express our gratitude to the staff of Bellingcat — especially Giancarlo Fiorella and Maxim Edwards — for their assistance in geolocating Q’s photos from East Asia, and for several stimulating conversations that didn’t make it into print.
**************************************************************************************
The hunt to identify the person or group behind the QAnon conspiracy theory continues. Known only as “Q,” this individual or collective is responsible for the many posts, or “drops,” that appeared on internet imageboards between October 2017 and December 2020.
It has not been an easy search. But a fresh approach has yielded more clues. Image metadata comprises many different kinds of information, some of which can speak to the origin of the image itself and, by extension, who created it. Since many of Q’s posts come with an image attached, examining image metadata can provide clues as to where Q has been — and when.
We examined metadata found on images associated with 27 Q drops. We infer from the metadata that the images are screenshots taken in two time zones: UTC+8 and the Pacific time zone. UTC+8 is a time zone including the Philippines, China, Mongolia, Taiwan, Malaysia, Brunei, and parts of Indonesia, Russia and Australia. Pacific time includes the West coasts of Canada and the USA, Nevada, part of Idaho, and part of the northwest coast of Mexico.
The vast majority of these images, ranging in date from November 7, 2017 to September 23, 2020, appear to originate from the Pacific time zone, while a handful of remaining images from February 2018 and 2019 appear to originate from UTC+8.
Above: a map with the Pacific time zone and UTC+8 highlighted (credit: Wikimedia and Robert Amour)
If accurate, the UTC+8 cluster of images could suggest that Q is a single individual who lives in the Pacific time zone but has traveled extensively in Asia (with stops at least in Hong Kong, Chongqing, Shanghai, and Bangkok, based on the contents of Q’s photos).
What is QAnon?
QAnon is a baseless conspiracy theory that flourished on the internet during the Trump era. Members of the online movement followed an anonymous poster, Q, who outlined Trump’s supposed plan to take down a global cabal of child-sacrificing elites. Claiming a high-level security clearance in the Trump administration, Q promised a bloody revenge on enemies like Hillary Clinton, Barack Obama, and George Soros. QAnon has drawn in new adherents during the COVID-19 pandemic, and radicalized members of the movement participated in the storming of the Capitol on January 6, 2021.
Those outside the movement dismissed Q’s declared identity as fantastical, and over time journalists assembled a list of figures who might be behind the account in reality. Vice News has argued that early Q drops were authored by a hacker collective and perhaps followed up by a right-wing operative. The new HBO Documentary, “Q: Into the Storm,” addresses suspicions about the previously speculated involvement of Ron Watkins and his father Jim, who were respectively the manager and owner of the website 8chan (and its successor 8kun), which was the exclusive platform of Q for all but the first month of Q’s existence.
The Dataset
We have made our code and results available in a Github repository, and hope other researchers will build on our findings.
We downloaded 1,720 image files from https://qalerts.net/media/. We also downloaded the JSON file of the text of the Q drops and their basic non-image metadata from https://qalerts.app/data/json/posts.json.
The collection of image files includes both images Q themselves posted and images in posts that Q replied to. Using the information in posts.json, we removed all images posted by anonymous users (“anons”) who were not Q. This results in a dataset of 1,087 images.
We then ran the “exiftool” program to extract image metadata from every image and collated the information into a spreadsheet. This CSV spreadsheet file contains one row per image and 275 columns. Not all columns are populated for each row, since individual images do not typically include every possible kind of metadata.
We spot-checked these photos in their original settings, i.e. on 8chan/8kun as well as 4plebs (a popular 4chan archive) to ensure that the image metadata was present in the original and not an artifact of qalerts.net’s collection process. We found that the metadata was indeed present in the original files. We also uploaded a few sample images to the existing 8kun website, and downloaded them again after they were posted. This allowed us to ascertain that the version of the 8kun website now running neither strips nor adds metadata to images stored on it.
Returning to our 1,087 images, we first checked to see which metadata fields were populated with interesting information, and followed up by reverse image-searching those which contained interesting or identifying information. This could have linked Q’s images to other individuals, broadening the scope of possible candidates.
It also weeded out images which Q had downloaded from elsewhere which were then uploaded alongside their drops.
Indeed, some images that looked promising turned out to have been taken from other websites with metadata intact. For instance, the image of a field that appears on drop 3985 was taken from the website of Brownfield News, a media network which covers agriculture in the US Midwest.
Image from Brownfield News, taken from a drop posted by Q.
By examining the metadata on the image taken from the Brownfield News website and matching it to the image downloaded from qalerts, we ascertained that all image metadata was inherited from its origin. That is to say, all of the metadata on the image posted to 8kun was also present on the image that was part of the earlier article. It seems like Q downloaded a copy of the image from the Brownfield News website and uploaded that copy to 8kun without altering any of the metadata.
But what about images from Q drops which appeared nowhere else online?
These seemingly original images proved to be the most interesting subset of all. Several of these images not only could not be matched easily to an online origin (so may be hypothesized to come directly from Q) but also contained enough metadata to analyze.
In particular, we soon zeroed in on a group consisting of 29 images whose UserComment fields all contain the word “Screenshot.” Not only are they marked as screenshots, all of these photos appear to be screenshots taken from within a mobile device’s photo gallery. Black bars can be seen above and below most of the photos, as well as elements such as the horizontal, elliptical bar at the bottom of the photo in drop 3642—clearly a user interface element.
Above: Q drop 3642
However, the strongest proof that these are screenshots comes from one of the images themselves: drop 4752 contains a screenshot, not merely of a picture Q has selected from within an iPhone’s image gallery and then photographed, but of the gallery itself. This is immediately recognizable to any iPhone user.
Above: Q drop 4752
Of the 29 photos labeled as screenshots, 27 also contain timestamp information in the field DateCreated. These 27 timestamped screenshots appeared in 29 Q drops (two images each appeared twice).
We calculated the time difference between the timestamp of the image metadata and the timestamp in UTC of the Q drop on the imageboard itself, and used this figure to make inferences about the time zone of Q.
Inferring Q’s Time Zone
The timestamp metadata associated with these images does not include a time zone. However, the time zone of the poster, expressed as a UTC offset, may still be inferred. To infer the time zone, we use the equation:
Local time of screenshot + time to post + UTC offset of screenshot maker = UTC time of post
or
Time to post + UTC offset of screenshot maker = UTC time of post − Local time of screenshot
or
Time to post + UTC offset of screenshot maker = calculated time diff
We know the right side of the equation and need the variables on the left. We assume that Q took a screenshot of a photo and then, minutes rather than hours later, a drop was made containing that image. For instance, the image in drop 125 was created at 15:39 local time (recorded by the device taking the screenshot) on July 7, 2017, and posted on 4chan at 15:43 Pacific time (UTC time 23:43). It’s not certain that only four minutes elapsed between the time the picture was processed and posted (rather than some number of hours plus four minutes), but it seems reasonable to assume.
Furthermore, we know that UTC offsets are constrained; the vast majority of them occur in hourly increments. For instance there is no such thing as a time zone that is one hour and 27 minutes past UTC. Therefore, the assumption that time to post was under an hour fixes the UTC offset for all 27 images.
Infographic by Robert Amour and Abigail W. Xavier
Examining the clusters near UTC−7 and UTC−8, we find that they correlate with changes enforced by Daylight Savings in the Pacific time zone. Pacific time changes from UTC−8 to UTC−7 and back over the course of a year. We believe these visually evident clusters provide strong evidence that images in Q drops are sourced from two time zones, UTC+8 and the Pacific time zone.
At the link below, you’ll find a data visualization.
https://bellingcat.github.io/q-image-metadata-viz/
Further Evidence for Time to Post
The data indicates that Q either waited for a handful of minutes after taking each screenshot before posting it, or that Q routinely waited for an unknown number of hours plus only a handful of minutes—which would be much more unusual behavior than simply posting right away.
In the case of drop 4752, we can verify that DateCreated is the local device time. Drop 4752 is in our Pacific time cluster, and the image in it includes the iPhone’s clock (which shows 12:07 at the time of the screenshot); our metadata also shows a creation time of 12:07. Q posted it at 12:13 Pacific time.
In general we see the same pattern for all Q drops with an image in the UTC−7 / UTC−8 cluster: for instance, drop 1206 has a screenshot taken at 18:16 local time on April 20, 2018 and posted at what corresponds to 18:18 Pacific time, while drop 1752 includes a screenshot made at 11:09 local time, which Q posted at 11:13 Pacific time.
A similar pattern holds for the UTC+8 cluster. Drop 682 contains a screenshot whose DateCreated metadata indicates that it was created at 8:38 local time. It was posted at 8:40 UTC+8 time. Similarly, drops 683–686 include screenshots containing a DateCreated value of 9:25 and 9:26 on August 2, 2018. They were posted between 9:35:08 and 9:36:59 UTC+8 time, a difference of 10 minutes. Finally, drop 2708 contains two photos that were taken at 18:27 and 18:28 local time, and posted at 18:31 UTC+8 time.
To bolster our confidence that time-to-post was within the hour and the remaining hour difference represents the device time zone’s UTC offset, we can observe the distribution of the time differences between the image’s creation date and the drop timestamp by minute within the hour. If the time to post were an hour or more on average, we’d expect to see a somewhat even distribution of minutes within the hour difference.
Infographic by Robert Amour and Abigail W. Xavier
However, the overwhelming majority of images appear to have been posted within 10 minutes, and none appear to have waited more than half an hour before being posted. This allows us to reasonably establish a pattern of behavior and to conclude that the time to post was within the hour, and that remaining hours of the difference represent the UTC offset of the device’s timezone.
Views from a Hotel Window
We know that Q, or an associate close enough to provide them with these photos, traveled to several locations in Asia — a fact which can be inferred not only from the context of these images, but their content. Several are photos of city skylines, others are close-up views of side streets. They generally do not include obvious tourist sites or any close-up individuals whatsoever — par for the course for Q, whose followers pore over images for arcane clues and metaphors.
For example, in drop 682, posted on February 8, 2018 (by UTC time), Q provided the following image of a modern skyscraper with a distinctive spire. (The black bars above and below the photo have been cropped in all images in this section.)
Q later posted one close-up photo of the awning over the building’s main entrance and another of the car park in front of it. These offered some small clues; cars bear blue license plates and a construction site to the right of the building features several bright red placards featuring Chinese characters. The words “Bank of China” can be seen on white backing on the building to the right.
Above: Q drop 682
All of these details suggest that the tower is in the People’s Republic of China — but where? By cropping the distinctive tip of the building and uploading the image into Yandex’s reverse image search, we soon find a match: the King Tower in Pudong, Shanghai.
It is fair to assume that the photo was taken from a tall building across the New Jinqiao Road to the South-West. According to the popular Chinese mapping website and search engine Baidu, this building is the Shanghai Marriott Hotel Pudong East (上海金桥红枫万豪酒店).
Above: screenshot from Baidu Maps
Two days later, on 10 February 2018, Q posted a close-up image of a large letter “E” hanging from a ceiling with distinctive alternating wooden slats.
Above: Q drop 707
In the bottom of the image, another item of a similar size and color can be seen hanging from the same ceiling. This leads us to assume that the letter “E” is one of a series in a zoning area — such as those found in airports. A simple Google search of airport arrival hallways in large cities in UTC+8 yields a result. An image from Shutterstock shows the same “E” hanging from the same ceiling at Shanghai’s Pudong airport:
Above: screenshot of Shutterstock’s website
Q’s next drop contained a photo from central Bangkok — Q may have meant to suggest that members of the “Q Team” had recently flown between Shanghai Pudong airport and the Thai capital.
The image below, posted in drop 708 on February 10, 2018, shows a city skyline. A building with the words “Assumption College” can be seen in the foreground.
Above: Q drop 708
The distinctive “pixelated” skyscraper in the background is the Maha Nakhon tower in the central business district of Bangkok. When completed in 2016, it was the tallest building in the Thai capital.
This photo appears to have been taken from a floor about midway up in a hotel called The Peninsula Bangkok or from a building on the same block with a similar vantage point, such as the River Condominiums or Light House Plaza.
The riverside campus of Assumption College is almost perfectly in line with The Peninsula Bangkok and Maha Nakhon. A user-uploaded photo on Google, taken from The Peninsula in March 2021, shows Assumption College and the Maha Nakhon tower from a similar, though higher, perspective to Q’s.
Image from Google Maps / The Peninsula Bangkok
On March 7, 2018 in drop 869, Q posted an image of a bustling market street in an East Asian country with a reference to Edward Snowden in the accompanying text. In the bottom right-hand corner above a meat stall, and on several banners in the center of the image, Chinese characters can be seen but are not completely legible. Bearing in mind that Snowden first fled to Hong Kong, it’s as good a place to start as any.
Q drop 869
The architecture and commercial profile of the area matches the narrow streets of Mong Kok, a popular shopping district in Hong Kong. A digital trawl through Mong Kok using Baidu’s streetview system shows a match at the crossroads of Nelson Street and Canton Street.
Above: image from Baidu street view
Importantly, Q’s image shows this intersection from high above, though not from a bird’s eye view. This suggests that the photographer was standing in a tall building to the east. The most obvious candidate is the nearby Cordis Hotel.
Images posted by guests of the hotel and tagged at the location can confirm this match further. In December 2020, one visitor to the Cordis posted a panorama photo of the Mong Kok skyline; the bottom left shows this same intersection in detail.
Image: Google Maps / Cordis Hotel
Nevertheless, it should be noted that the screenshot of Q’s image from the Cordis Hotel was created by a user in the Pacific time zone, from which it can be inferred either that Q did not post all images “live” (and might have selected it from their own old photos), or that Q was posting images they had received from a contact.
On February 14, 2019, Q posted Drop 2706, which included a photo of a shopping street somewhere in a Chinese-speaking country. Unlike the previous two images, which each contain a famous skyscraper, this image was unremarkable. However, as a close-up image it did show several names of businesses such as 朋泉聚，周师兄 (Old Brother Zhou)，中国民生银行 (China Minsheng Bank), as well as 诗丽堂美容SPA (Shilitang Beauty SPA, also known by its English name Silktone SPA). Two of these are business names concentrated in Chongqing, a city in South-West China.
Above: Q drop 2706
As it offers a highly detailed business registry for China, Baidu Maps is the ideal source to start searching. It also offers an extensive streetview mode which allows users to compare imagery taken in different years. After checking street view imagery for various addresses for Silktone Beauty SPA branches in Chongqing, we have a match on the city’s Beijeng Tiangje Street (北城天街). It shows the same shopfront, the same names of all businesses, the same covered bus shelter, and the same distinctive streetlights:
Image: Baidu Maps
Q’s photo of the entrance was taken from above, from a building across the road to the North-East. Baidu’s map shows a highly likely candidate: the Chongqing Fuli Hyatt Regency Hotel.
Further corroborating this is another image Q posted in the same drop, showing the lights of buildings and a distant cityscape at night. Blurring suggests that this was taken at speed, presumably from an aircraft.
Above: Q drop 2706
The layout of the roads and buildings matches those to the right of Chongqing Airport’s eastern runway, approaching from the South.
Image: Google Maps
Importantly, drop 2503 from November 2018 includes a photo from the hotel, including a Christmas tree. That same month, in drop 2516, Q congratulated “anons” for successfully geolocating the “last pic” to Chongqing, urging them to “watch the news”.
If these images are, as they appear to be, original, then we know the location of the photographer, and can infer the location of the person who took the screenshot, but not necessarily that of the person who posted the respective drops: it is at least conceivable that whoever took the screenshots might have texted or emailed these photos to a third party, who posted them shortly afterwards.
Nevertheless, the images do teach us a few new things about Q.
We know that Q, or a very close associate, flew to Shanghai Pudong Airport prior to February 8, 2018; that they stayed at The Peninsula hotel in Bangkok prior to or on February 10, 2018; that they stayed at the Cordis Hotel in Hong Kong prior to or on March 7, 2018; that they stayed at the Chongqing Fuli Hyatt prior to or on February 14, 2019 and flew into Chongqing prior to that same date.
We know that Q, or an associate who regularly provides images for Q to post, has a particular taste in hotels and has spent time traveling, but likely not living, in four cities in Thailand and China. The fact that some of the images in China can also be geolocated to the same timezone makes the assumption about Q’s location, or the location of somebody working with Q, more plausible.
One Step Closer?
The overwhelming majority of the images in our data set — over 68 percent — appear to have been created by a user, or users who were in the Pacific time zone. Q’s content appears to have been posted from the Pacific time zone at least as early as November 7, 2017 and at least as late as September 23, 2020; this covers almost the entire period that Q was active.
By contrast, images from UTC+8 exist on only three dates in our data: February 8, 2018, February 10, 2018, and February 14, 2019.
This has several potential implications for Q’s identity.
First, these findings are consistent with the hypothesis that the same person has been posting as Q all along. In that case, Q would live or spend the vast majority of their time in the Pacific time zone, with occasional international travel. The hypothesis of a Pacific Q coheres with other quantitative work on the overall hourly patterns of the Q drops, while the hypothesis of a single Q matches the observed fact that Q had access to the same set of photos in November 2017 and May 2018.
Second, the most popular hypothesis among Q-watchers — that authorship of the drops changed hands between January 4 and January 6 of 2018 — cannot be excluded on the basis of our findings. Under this hypothesis, our evidence requires new Q and original Q both to post from Pacific Time.
That’s not impossible, of course. There are well over 50 million people living in the Pacific time zone; one of them could easily have stepped into the original Q’s place.
We reached out to Jim Watkins, the owner of 8chan/8kun who has lived in the Philippines, to comment on the implications of narrowing down Q’s timezone. In an emailed response crowdsourced via his Gab account, Watkins cast doubt on the methodology of the research and its usefulness, adding that more than a billion people live in the UTC+8 time zone. Watkins has previously denied in comments to Bellingcat that he is Q.
Bellingcat was unable to reach Ron Watkins, who has lived in Japan, for comment. Ron Watkins has also denied that he is Q in the course of the recent HBO documentary series.
It is important to stress our evidence is not by itself sufficient to identify any particular individual as Q or an associate of Q.
However, our evidence should provide a valuable datapoint for other investigators who seek to do so. The hunt for Q goes on — and these findings suggest that it must largely continue in the Pacific time zone.
Gavin Fox (pseudonym) contributed to this research.