The threatening letters came in envelopes carrying a symbol associated with the far-left antifa movement: black and red flags inside a white circle. They warned of bombings, shootings, rapes and other violence against organizers and attendees of Civil War reenactments in Virginia and Pennsylvania, calling the events a celebration of slavery and “atrocity of history.”

When the annual reenactment of the Battle at Cedar Creek went on as planned in October 2017, an undetonated pipe bomb was discovered. Additional “antifa,” or antifascist, threats arrived over the following months, leading to the cancellation of the 2018 event and sending a chill through the groups that have long hosted the gatherings.

But a newly unsealed search warrant reveals that the FBI believes the threats and the pipe bomb were the work of a onetime member of the Cedar Creek Battlefield Foundation itself. The 37-page warrant, first reported by Quartz on Tuesday, makes the case against Gerald Leonard Drake, a 61-year-old Virginia man who was ousted as a reenactor in 2014 over a dispute involving a member trying to sneak in without paying.

“The Antifa symbols, as well as the content of the letters, may have been used to disguise the writer’s true identity,” an FBI agent wrote in the warrant, “and add legitimacy to the threats.”

The letters had been taken by some as a sign that the national debate over Confederate-era symbolism had spilled over into Civil War reenactments. Though details of the threats were not made public, online speculation centered on antifa as the culprit.

Drake’s alleged connection to the case was not known until this week. The former Cedar Creek Battlefield Foundation volunteer and registered sex offender, who served jail time in 2004, has not been charged with a crime in Virginia federal court related to the attacks. The U.S. Attorney’s Office for the Western District of Virginia declined to comment; Justice Department policy prohibits public discussion of investigations that have not led to charges.

“Mr. Drake has no idea why he was being investigated,” his lawyer, Anna Chludzinski, told The Washington Post. “We have not received any information as to why the warrant was unsealed.”

“He was a longtime, loyal member of the group putting on that event,” she added, and “it defies reason that he would be motivated to disrupt the event, and endanger himself and his comrades.”

News that the alleged source of the threats had been identified came as a relief to Jeannette Shaffer, president of the Virginia Cedar Creek Battlefield Foundation, who was on the receiving end of some of the threats. But she said she and other reenactors would feel better if an arrest was made.

The fact that authorities are investigating “one of our volunteers upsets me some,” Shaffer said. “It makes me wonder how long this had been going on and how long we were actually in danger.”

The first of the threatening letters arrived in September 2017, about a month before the Cedar Creek Battlefield Foundation’s annual reenactment of the Battle at Cedar Creek, according to the warrant. The writer demanded the event be canceled, calling it a “celebration of the Civil War.”

The letter made promises that urine and dog feces would be thrown at attendees, that tires would be slashed and traffic blocked.

“If you choose to continue with this farce of history, that clearly celebrates the war to keep African-Americans in chains, than we have no choice but to come and protest,” the letter said. “We will make Charlottesville look like a Sunday picnic!”

At least eight other letters were sent between September 2017 and December 2018 targeting the group and its leaders, along with the organizers of the Gettysburg Remembrance Day Parade in Pennsylvania. Some singled out recipients’ families and children; one targeted Shaffer’s daughters. They threatened to set fires, place bombs in stores, run people over with trucks and place a shooter on a rooftop.

Most bore the antifa-associated symbol in the upper left-hand corner in place of a return address.

According to the warrant, investigators began to consider that the threats were coming from someone familiar with the group after noting that some of the 2018 letters contained information that was discussed at foundation meetings and not publicly announced. In one instance, a July 2018 letter warned, “We now have plastic bombs, so metal detectors are useless!” Board members told the FBI they had discussed using metal detectors at a meeting that year.

Others threatened to kill people who were not publicly associated with the group, or revealed intimate knowledge of the operation of the Cedar Creek Battlefield Foundation and its visitor center.

Video surveillance — including a civilian’s drone — showed a car that resembled Drake’s distinctive blue Hyundai Tucson on the battlefield site not long before the pipe bomb was discovered, the warrant said. The FBI also learned that while jailed for the 2004 sex crime, Drake drew a detailed diagram of a pipe bomb that strongly resembled the one found at Cedar Creek.

Shaffer said that because of questions asked by the FBI over the past year and a half, “we sort of suspected, but we hadn’t officially been told” that the FBI considered Drake a suspect. But she added, “You want to trust people, you want to think the best of them.”

With the warrant sealed until recently, Quartz noted, online commenters “blamed the situation on, variously, ‘lib terrorists,’ ‘attention-seeking organizations and anarchists,’ and ‘leftists.’” Conservative media outlets questioned whether Civil War reenactments would “become the next casualty of America’s culture war.”

“Another day another registered sex offender sends pipe bombs & death threats to the civil war reenactment group he was kicked out of & attempts to frame up antifa for the crimes,” Antifa International wrote in a tweet on Wednesday.

Read more: