Toy Rabbits, Chemtrails and German QAnon Fanatics: How Not to Conduct Open Source Investigations – bellingcat

The posts boast of uncovering an incident of child abuse in southern Germany and the seemingly suspicious use of military aircraft in the north and west of the country. Others detail a conspiracy to manipulate significant weather events.

Impressively, all that was required to reveal this malign activity was some creative thinking and access to open source investigative tools such as satellite mapping services and flight tracking sites.

But a closer look begins to reveal some fundamental problems.

The tools had been misused and the findings, eye-catching though they are, fail to stand up to even the most basic scrutiny.

It’s a familiar theme when analysing “research” from the QAnon community.

While it initially attracted adherents in the US and focused on outlandish conspiracies surrounding American politics, QAnon has since evolved and spread to other countries around the world.

One country where QAnon has had a significant impact is Germany, as widely reported by local and international media. The black and white, good versus evil, template of the conspiracy has made it particularly supple, say experts. According to a 2020 report on QAnon in Germany by the Antonio Amadeu Stiftung — a Berlin-based NGO which works to combat racism and far-right extremism — the conspiracy has resonated with other fringe groups in German society such as the Reichsbürger (a far-right movement which denies the legitimacy of the German state) and the Querdenker (Covid-19 sceptics and denialists).  

Bellingcat delved into the German-language QAnon ecosystem as part of a wider project that aims to track the spread of the conspiracy theory throughout Europe.

What is QAnon?

QAnon is the conspiracy that falsely posits former US President Donald Trump has long worked to defeat a Satan-worshipping, paedophile “cabal” operating within the American “deep state.”

Despite Trump being voted out of office and the repeated failure of QAnon prophecies to come true, the conspiracy has continued to attract adherents. It has also pollinated a host of other harmful theories (such as those propagated by anti-vaxxers and the movement against 5G wireless technology).

While Q “drops” have ceased in the wake of Trump’s electoral defeat, Q’s followers remain active in this and a number of other evolving conspiracies.

Where the movement will go or how it will develop if the mythical person or people known as “Q” do not return, however, is not entirely clear.

The research — which gathered millions of posts from Telegram channels that regularly shared QAnon-related content— found that many of the same conspiracies, as well as mantras encouraging self learning and independent online discovery popular in English language QAnon communities, were also apparent in German language QAnon channels.

Some English language QAnon enthusiasts have set up online depositories that list a range of databases, records, pointers and tools for enthusiasts around the world to get involved in the crowdsourced conspiracy and carry out their own investigations – usually to misleading effect.

Similar trends were observed in German language QAnon Telegram channels.

Here, open source investigative tools appeared to be influential in creating a host of new, potentially harmful theories off the back of prominent news events in Germany, Switzerland and Austria.

Although this pattern of behaviour is highly unlikely to be unique to Q followers in these countries, analysis of how the tools had been used offered an interesting insight into the regional evolution of QAnon and how it has been adapted for German language audiences. 

It also offers some textbook examples of how not to conduct open source research or investigations. Google Maps, for instance, was used to falsely bolster an online claim that a 2020 shooting in the Austrian capital, Vienna, was faked. It was also seen being used by Q enthusiasts to promote panicked claims of child abuse for which there was no evidence.

While Google Maps has myriad non investigative uses – such as providing directions – it can also be used to aid practices such as geolocation. 

In Bellingcat’s dataset, the keyword “Google Maps,” was found 427 times during the period between April 2019 and October 2021. 

This may appear insignificant in the grand scheme of things. But it is important to note that not every Q follower captured in the dataset mentioned the specific name of this tool in posts when using it. Others could be seen using more vague language such as “satellite imagery” or even just posting screenshots from online mapping services.

Other tools to be frequently mentioned and used by German language Q followers included flight tracking sites, patent databases and business registries. Some posts promoting theories devolved from the mis-use of these tools had racked up tens of thousands of views.

Despite that, most German language Q enthusiasts observed by Bellingcat did not appear to consider themselves open source researchers in the traditional sense, or even be aware of the field.

The term “open source investigations” is not common in the German language and many Q enthusiasts simply referred to their own “research” (Recherche), with that word appearing tens of thousands of times in posts.

 This is also a regular refrain in English language QAnon communities as well as in other conspiracy movements such as those associated with anti-vaxxers, Covid-19 truthers or 5G theories. 

To be clear, not all of the theories found during Bellingcat’s German language research were borne from poorly conducted open source research.

But some of the most popular and far-spreading were.

Google Maps and the White Rabbit

For example, one Telegram user who posted to a channel with 25,000 subscribers in March 2021 falsely described uncovering an alleged incident of child abuse by using Google Maps to investigate a seemingly innocent story that had appeared in a German tabloid. The article detailed how a child in the Bavarian town of Aschaffenburg had lost his toy rabbit while at a supermarket.

In QAnon communities, rabbits are seen to represent clues to hidden truths. “Follow the white rabbit” is a widely-used slogan, adapted from Lewis Carroll’s famous story “Alice’s Adventures in Wonderland.”

The Telegram user posted that they had located the supermarket detailed in the newspaper story on Google Maps. Nearby, they found a restaurant called Tadsch Mahal, as well as a pizzeria. Tadsch Mahal, the German spelling of Taj Mahal, was interpreted as a connection to Donald Trump (since Trump previously owned a casino called Trump Taj Mahal in Atlantic City, New Jersey). The pizzeria, meanwhile, was taken as a reference to the debunked Pizzagate conspiracy which posited that US Democratic Party officials were involved in a trafficking ring that operated out of the basement of a pizza restaurant in Washington DC.

The poster failed to provide any evidence that actually connected these locations beyond their proximity to one another on Google Maps and some unhinged themes that have become prominent in the Q conspiracy. They also shared no actual evidence of any child abuse, just stating that the child had a toy rabbit.

Despite these clear logical leaps, the post obtained a not insignificant reach. At time of publication, it had been viewed just under 13,000 times.

For an open source researcher of even mild competence, such basic fallacies and logical inconsistencies would be clear.

Chemtrails, Flight-tracking Sites

Another clear observation from Bellingcat’s German language Telegram analysis was Q followers’ interest in flight tracking tools. These platforms have been used by competent open source researchers to track the final moments of downed passenger aircraft like Flight PS752 over Tehran in 2020 as well as small planes allegedly involved in drug trafficking.

But German speaking QAnon followers primarily showed a tendency to use flight tracking sites self-selectively, in order to seek proof of concepts such as “chemtrails”.  This is yet another unsupported theory that claims condensation trails left by aircraft consist of chemical substances that are sprayed on human populations in order to manipulate them physically and psychologically.

Bellingcat even found a German language flight tracking tutorial produced by a conspiracy theorist for fellow believers in chemtrails.

Despite appearing to use these tools extensively, QAnon followers often seemed unsure as to how they should apply them to support their claims. Some focused on the shapes created by the flight paths planes take. One German conspiracy theorist shared the below picture depicting the shape of a rabbit which was captured on Flightradar24.

This flight took place when a pilot flew over Berlin to create a rabbit shape just before Easter in April 2020. Despite acknowledging that this was “probably an Easter gag”, the uploader who noted it began their post with the slogan: “Follow the white rabbit.” According to this poster, the rabbit shape was “at least a synchronicity”.

Bellingcat’s Investigative Tech Team also found a dedicated German-language conspiracy theorist community which focuses on interpreting what they call “parallel flights” or “ring flights,” named after the shape of visible routes detailed on flight tracking sites. Often, the community tries to establish a connection between those flights and child abuse, again for reasons that are unclear and that seem lacking in clear logic beyond their existence in Q mythology.

Bellingcat came across this community after noticing an increasing number of posts in the Telegram database had been referring to the flight-tracking website globe.adsbexchange.com since the beginning of 2021.

At that time, a group of German conspiracy theorists appeared to be using the site to try and to keep track of the US Doomsday plane, speculating whether President Trump was on board.

From March 2021 onwards, however, the site appeared to be used primarily in a German context. Users shared screenshots of flights they noticed taking place close to where they lived or in regions familiar to them. One Telegram channel, which had more than 15,000 followers at time of publication, regularly shared screenshots of “parallel” or “ring” flights that were visible on globe.adsbexchange.com, a popular flight tracking website.

The channel owner mainly focused on sharing screenshots upon which they rarely commented. They also linked to a comments section where they asked followers to write down their thoughts about the observed flights.

Screenshot of the comments section of the German “flight spotter” community on Telegram.This forum offered an interesting example of a space where conspiracy theorists and genuine aviation enthusiasts appeared to unwittingly meet. This is likely due to the  channel’s seemingly benign name, attracting flight hobbyists as well as those from the conspiracy community with a newfound interest in flight tracking. It is not entirely clear whether the channel owner is a Q conspiracist  or flight enthusiast, although they do not seem bothered by the fact that QAnon enthusiasts are eager followers and commenters.

One user, for instance, wondered whether “ring” and “parallel flights” close to the locations of newly found World War II bombs in Germany could have something to do with a search for “DUMBS”. QAnon followers believe that “Dumbs” (in the German conspiracy world sometimes also called “dumps”) are “deep underground military bases” in which the “deep state” hides and mistreats children.

In the same comments section, however, another user refutes these conspiracy theories, arguing that aircrafts flying in parallel lines close to World War II bomb sites are likely supporting the work of bomb disposal units. “Ring flights,” according to this commenter, are most probably test flights taken by recently repaired aircraft. Several other users in the comments section also tried to disprove the QAnon conspiracies.

While these interactions may just appear eccentric, they raise more serious questions as to whether individuals unfamiliar with the conspiracy could be unwittingly drawn into them.

Members of German QAnon Telegram channels also complained that planes or helicopters seen in the sky were not visible on tools like Flightradar24. Conclusions, usually misinformed, were then drawn from these observations. In one example found by Bellingcat, a QAnon follower posted that they had observed military helicopters flying over a town near Aachen, close to Germany’s borders with Belgium and the Netherlands. These helicopters were apparently not visible on Flightradar24, so the poster asked whether they may be part of “hidden operations.” As is customary for many posts in Q communities, no evidence was provided for the claim that helicopters were indeed flying at the time specified. Meanwhile, as noted in the “how it works” section of the FlightRadar24 website, not all helicopters do have ADS-B transponders (although some more modern ones do). It is also the case that flight tracking platforms in general don’t have perfect coverage, meaning that they don’t display 100% of the aircraft that are in the air at any given moment. It is therefore very possible that those highlighted would not show up on the platform. Despite this less dramatic explanation for these flights’ absence, the post had been viewed more than 12,000 times.

Random lines as fake “evidence” for the causes of climate change

QAnon followers in Bellingcat’s dataset appeared to make use of several other types of open source tools to pursue their theories. 

In one example, a post shared widely in QAnon themed Telegram channels combined data from the weather website windy.com and the patent search engine, Google Patents. In doing so, the uploader sought to disprove the existence of climate change. 

As with the vast majority of theories that emanate from the QAnon movement, however, the analysis again lacked logical consistency or evidence that stood up to basic scrutiny.

The user presented plans found on Google Patents for a “hurricane and tornado control device” as proof that weather patterns were being manipulated.

They even produced a video which at one stage zoomed into an image of a typhoon, drawing the audience’s attention to seemingly random line formations visible at the edge of the picture. These lines are described as frequencies, a term used in the patent.

The uploader then implies that because the patent describes how weather could theoretically be manipulated, the device is secretly being used to create meteorological events. The video ends with the narrator asking:  “Who or what is climate change? Is it real? Would it also be there without those frequencies that influence weather systems?”

As with the earlier example of the toy rabbit, the poster provides no evidence as to why their conclusions make sense. Nor do they address why the information contained within the patent is correct, verified or to be trusted. 

It seems they have come to the conclusion — or perhaps rationalised a conviction they already held — that climate change is manipulated purely because they found a defunct patent online then extrapolated from there.

Do QAnon followers consider themselves open source investigators?

The Telegram posts detailed in this article clearly show that Q enthusiasts are far from experts at understanding or employing open source research methods. 

Yet they also seem to be adopting more than just the technical tools used by more competent and trustworthy investigators. 

Some Q followers were observed encouraging others to work together. As Bellingcat has previously explored, the collaborative and crowdsourced nature of QAnon is a key reason for the conspiracy’s success. Collaboration is also a key aspect of open source investigations, with groups of people filtering through large numbers of social media posts or geolocating several videos at once. Crowdsourcing is also common to provide further scale and sift through even more data, videos or analysis at a quicker pace.

One German QAnon channel with approximately 150,000 subscribers begins with a post that says: “We are an open source team, which consists of mostly anonymous, voluntary helpers, where everyone contributes a small part.”

Another German language Telegram channel defined QAnon as a “peaceful, worldwide open source intelligence service movement which is anchored in intellectual sovereignty, research, love of our countries, of humanity and — for most — of God.”

Overall, however, the German language QAnon community does not extensively use the term “open source investigations.” This is not surprising since it is an English language term not widely known in German-speaking countries. The term has also not yet found a common German translation (Bellingcat uses “Open-Source-Recherchen” in German). 

When the phrase open source does show up in Bellingcat’s dataset (447 times), it often refers to German translations of Q drops in which the word “open source” has been kept untranslated. For instance, a German language post about the disgraced socialite Ghislaine Maxwell contains the term “open source” with readers encouraged to “follow the family” — likely a reference encouraging readers to further look into the Maxwells.

More frequently, though, the German-speaking QAnon community simply refers to the verb or noun “research” (which are two separate words in German) to describe what they think they are doing. These terms showed up 11,815 and 2,988 times respectively in Bellingcat’s Telegram database from early 2019 to October 2021. The use of the term “research”  is common in English language Q communities as well. “Do your own research” or “I do my own research” have also become phrases used by those in the anti-vaxx or 5G conspiracy movements.

In a post with the title “What is Q?” one follower described QAnon’s aim as “to create a reason which justifies that you opt for online research and not for the TV broadcast” after a long working day. The poster hoped that through QAnon followers would be “motivated to find out, to learn and to investigate further.” 

Other Telegram posts describe “research” as simply consuming what other QAnon posters produce. For example, a QAnon Telegram poster suggested: “Go to my or one of the other Anon’s Facebook pages, read and digest the things that we say and write. Then you look at the topics you are interested in. That’s how you research and learn.” 

As with all the examples in this article, however, such advice is not a sound basis for research or investigation, open source or otherwise. 

Satellite Maps, flight tracking websites and publicly available weather monitoring systems can all be harnessed by individuals and researchers for both simple and complex tasks. But they cannot prevent people from a movement known for its baseless conspiracies misinterpreting the information such tools can provide, or employing them to try and support clearly false premises.

The tools, employed in this way, only appear to push Q enthusiasts further down rabbit holes of their own creation. The result is more convoluted, misleading and potentially harmful conspiracies.

In the German context, it has also helped further localise the Q conspiracy.

---

Editor’s note: Bellingcat has removed some of the links in this article to prevent their spread online. If individual researchers would like to access the posts detailed in this story, please contact the Bellingcat Investigative Tech Team here. 

Bellingcat’s Investigative Tech Team develops tools for open source investigations and explores tech-focused research techniques. Do you have a question about applying these methods or tools to your own research, or an interest in collaborating? Contact us here.

Logan Williams contributed to this story.