In the mountain of commentary that has been published about the Kathy Sierra affair on blogs and in mainstream publications, one fact has so far remained obstinately unconfirmed: Who was it that posted threatening messages and images on Sierra's website and on two other blogs?

Wired News interviewed many of the principals in the original affair, including Sierra; Frank Paynter and Chris Locke, the creators of the meankids.org blog; and other contributors to meankids.org. Our goal was to find out who actually posted the threatening content.

The investigation so far has led to two people, a meankids.org contributor and a commenter, who have acknowledged to Sierra that they authored content she found threatening. Sierra no longer considers these individuals as physical threats to her, and has agreed to keep the identity of one of them secret. There are at least two other people whose identities remain uncertain, however.

Identifying these perpetrators has proven impossible because most of the evidence has been destroyed, including server logs, IP addresses and the threatening content itself. Although others have identified a prime suspect, he has an alibi, which is impossible to confirm or debunk.

An account of the case can be gleaned from publicly available sources online, but it has so far been spread across dozens of blogs and thousands of comments. One exception is Jim Turner at One By One Media has the only comprehensive factual account we have found.

What follows is a fairly full summary of the case, based on facts Wired News has been able to verify.

The controversy broke March 26, when Sierra canceled an appearance at the ETech technology conference citing online threats against her against her life. Sierra contacted the Boulder Sheriff's Department, which advised her to take the threats seriously.

Sierra, who is the author of several Java programming books as well as a marketing blog called Creating Passionate Users, reported she'd received death threats in the comments section of her own blog. Additionally, Sierra said, threatening images and commentary had appeared on meankids.org, a group blog that is now offline.

It's not clear what provoked such a vitriolic response to Sierra. She attributes it to comments she made a year ago in support of bloggers' rights to delete comments on their own blogs.

Reaction to Sierra's announcement was swift and polarizing, with many people remarking on the viciousness of the commentary, and others defending the original posts on meankids.org as non-threatening satire.

"I think it touched a nerve," Sierra said. "People had so much pent-up fear, anger, frustration, hurt over their own experiences, and it just opened up the floodgates."

Our investigation revealed a few facts that are not disputed by any of the parties we interviewed:

· A contributor using the moniker "Rev Ed" was responsible for two of the most controversial posts on meankids.org, including one with a doctored image of Maryam Scoble (wife of tech blogger Robert Scoble) and a second post with a doctored image of Sierra. It is the second image that Sierra found particularly threatening; she posted a copy of this to her own blog but the image has since been removed. (It showed Sierra's face covered by lacy red women's underwear, and seems to have been based on this image posted on Flickr.)

· The nickname "Rev Ed" belonged to meankids.org contributor Alan Herrell, a Phoenix, Arizona-based computer and networking consultant, or someone posing as him. In an e-mail published after the Sierra affair broke, Herrell claimed his computer had been hacked and his identity stolen – that whoever was posting to meankids.org under the nickname "Rev Ed" was not him. The blog's creator, Paynter, said he initially suspected Herrel, but the hacking story cast doubt on that suspicion. "My impression that (Rev Ed) was Alan is now tempered by Alan's statement that he was hacked," Paynter said. Herrell could not be reached for comment.

· Another post, which included an image of a noose, was made by a meankids.org contributor who later acknowledged authorship of that post to Sierra. Sierra acknowledged this poster's explanation and no longer considers the poster a physical threat. The contributor, who has asked not to be identified, confirmed this version of events.

· Paynter provided the e-mail address and IP address of a meankids.org commenter called "Joey" to Sierra. This person had added a comment to the noose post that said, "The only thing Kathy has to offer me is that noose in her neck size." Joey has contacted Sierra, and has offered his own account on another website.

· The most direct threats were posted to Sierra's own blog. Sierra published the e-mail address and IP address of a commenter, "siftee," in her March 26 post, along with one of the commenter's threats, which is patently violent and sexual. The IP address indicates a user probably located in Spain, but attempts to contact this person by Wired News have so far been unsuccessful.

Getting to the bottom of the Sierra affair is complicated by the fact that meankids.org (as well as a second blog with many of the same contributors, unclebobism.wordpress.org) is now offline. Paynter and Locke deleted the sites as soon as they felt the content was becoming unacceptable. Paynter retained none of the data or server logs for meankids.org, which was hosted on his server. Unclebobism.wordpress.org was hosted by Wordpress.com, and Automattic, which operates Wordpress.com, declined to share server logs or web pages from the deleted account with Wired News.

The content of both sites is no longer available in public repositories, such as the Internet Archive or Google's cache. As a result, it's difficult to establish who posted what, and attempts to determine the threatening content of the posts is impossible because the posts themselves are unavailable for examination.

Additionally, Herrel's claim that his computer was hacked means that server logs, even if available, would not be conclusive.

In the absence of public facts, such as server logs or even the blogs themselves, it is no surprise that public debate has been dominated by opinion and interpretation. There is only one certainty: For most commenters – whether mainstream media or bloggers – the absence of evidence has never been an obstacle to offering a strong opinion.

Comment on this story.