Toy Rabbits, Chemtrails and German QAnon Fanatics: How Not to Conduct Open Source Investigations

The posts boast of uncovering an incident of child abuse in southern Germany and the seemingly suspicious use of military aircraft in the north and west of the country. Others detail a conspiracy to manipulate significant weather events.

Impressively, all that was required to reveal this malign activity was some creative thinking and access to open source investigative tools such as satellite mapping services and flight tracking sites.

But a closer look begins to reveal some fundamental problems.

The tools had been misused and the findings, eye-catching though they are, fail to stand up to even the most basic scrutiny.

It’s a familiar theme when analysing “research” from the QAnon community.

While it initially attracted adherents in the US and focused on outlandish conspiracies surrounding American politics, QAnon has since evolved and spread to other countries around the world.

One country where QAnon has had a significant impact is Germany, as widely reported by local and international media. The black and white, good versus evil, template of the conspiracy has made it particularly supple, say experts. According to a 2020 report on QAnon in Germany by the Antonio Amadeu Stiftung — a Berlin-based NGO which works to combat racism and far-right extremism — the conspiracy has resonated with other fringe groups in German society such as the Reichsbürger (a far-right movement which denies the legitimacy of the German state) and the Querdenker (Covid-19 sceptics and denialists).  

Bellingcat delved into the German-language QAnon ecosystem as part of a wider project that aims to track the spread of the conspiracy theory throughout Europe.

The research — which gathered millions of posts from Telegram channels that regularly shared QAnon-related content— found that many of the same conspiracies, as well as mantras encouraging self learning and independent online discovery popular in English language QAnon communities, were also apparent in German language QAnon channels.

Some English language QAnon enthusiasts have set up online depositories that list a range of databases, records, pointers and tools for enthusiasts around the world to get involved in the crowdsourced conspiracy and carry out their own investigations – usually to misleading effect.

A QAnon supporter is pictured with a flag at Schiller Park in the city of Leipzig, Germany, in November 2020 (Credit imago images/Steffen Junghans via Reuters)

Similar trends were observed in German language QAnon Telegram channels.

Here, open source investigative tools appeared to be influential in creating a host of new, potentially harmful theories off the back of prominent news events in Germany, Switzerland and Austria.

Although this pattern of behaviour is highly unlikely to be unique to Q followers in these countries, analysis of how the tools had been used offered an interesting insight into the regional evolution of QAnon and how it has been adapted for German language audiences. 

It also offers some textbook examples of how not to conduct open source research or investigations. Google Maps, for instance, was used to falsely bolster an online claim that a 2020 shooting in the Austrian capital, Vienna, was faked. It was also seen being used by Q enthusiasts to promote panicked claims of child abuse for which there was no evidence.

By extracting links from the Telegram database, the connections between channels and the websites they link to can be illustrated. Here, a number of websites sometimes used by open-source investigators are linked to, including flight tracking, corporate registration, Open Street Map, and live webcam sites. (Visualisation: @Logan Williams).

While Google Maps has myriad non investigative uses – such as providing directions – it can also be used to aid practices such as geolocation. 

In Bellingcat’s dataset, the keyword “Google Maps,” was found 427 times during the period between April 2019 and October 2021. 

This may appear insignificant in the grand scheme of things. But it is important to note that not every Q follower captured in the dataset mentioned the specific name of this tool in posts when using it. Others could be seen using more vague language such as “satellite imagery” or even just posting screenshots from online mapping services.

Other tools to be frequently mentioned and used by German language Q followers included flight tracking sites, patent databases and business registries. Some posts promoting theories devolved from the mis-use of these tools had racked up tens of thousands of views.

Despite that, most German language Q enthusiasts observed by Bellingcat did not appear to consider themselves open source researchers in the traditional sense, or even be aware of the field.

The term “open source investigations” is not common in the German language and many Q enthusiasts simply referred to their own “research” (Recherche), with that word appearing tens of thousands of times in posts.

 This is also a regular refrain in English language QAnon communities as well as in other conspiracy movements such as those associated with anti-vaxxers, Covid-19 truthers or 5G theories. 

To be clear, not all of the theories found during Bellingcat’s German language research were borne from poorly conducted open source research.

But some of the most popular and far-spreading were.

Google Maps and the White Rabbit

For example, one Telegram user who posted to a channel with 25,000 subscribers in March 2021 falsely described uncovering an alleged incident of child abuse by using Google Maps to investigate a seemingly innocent story that had appeared in a German tabloid. The article detailed how a child in the Bavarian town of Aschaffenburg had lost his toy rabbit while at a supermarket.

In QAnon communities, rabbits are seen to represent clues to hidden truths. “Follow the white rabbit” is a widely-used slogan, adapted from Lewis Carroll’s famous story “Alice’s Adventures in Wonderland.”

The post starts with the title “no coincidences any more” followed by the QAnon hashtag #Pedomatrix which refers to the topic of child abuse. It then describes that there is a restaurant and a pizzeria close to the supermarket and ends with the words “Oh, this is all only a coincidence” (the screenshot was cut at the bottom to protect the child’s photo).

The Telegram user posted that they had located the supermarket detailed in the newspaper story on Google Maps. Nearby, they found a restaurant called Tadsch Mahal, as well as a pizzeria. Tadsch Mahal, the German spelling of Taj Mahal, was interpreted as a connection to Donald Trump (since Trump previously owned a casino called Trump Taj Mahal in Atlantic City, New Jersey). The pizzeria, meanwhile, was taken as a reference to the debunked Pizzagate conspiracy which posited that US Democratic Party officials were involved in a trafficking ring that operated out of the basement of a pizza restaurant in Washington DC.

A Google maps screenshot from the area of the supermarket in the German town Aschaffenburg. Bellingcat marked the supermarket, the restaurant and the pizzeria between which the QAnon channel made up a connection (the QAnon Telegram post did not include any screenshots).

The poster failed to provide any evidence that actually connected these locations beyond their proximity to one another on Google Maps and some unhinged themes that have become prominent in the Q conspiracy. They also shared no actual evidence of any child abuse, just stating that the child had a toy rabbit.

Despite these clear logical leaps, the post obtained a not insignificant reach. At time of publication, it had been viewed just under 13,000 times.

For an open source researcher of even mild competence, such basic fallacies and logical inconsistencies would be clear.

QAnon-themed graffiti with a white rabbit and the conspiracy’s popular ‘WWG1WGA’ slogan. Brandenburg an der Havel, Germany, March 2021. Photo (c): Maxim Edwards

Chemtrails, Flight-tracking Sites

Another clear observation from Bellingcat’s German language Telegram analysis was Q followers’ interest in flight tracking tools. These platforms have been used by competent open source researchers to track the final moments of downed passenger aircraft like Flight PS752 over Tehran in 2020 as well as small planes allegedly involved in drug trafficking.

But German speaking QAnon followers primarily showed a tendency to use flight tracking sites self-selectively, in order to seek proof of concepts such as “chemtrails”.  This is yet another unsupported theory that claims condensation trails left by aircraft consist of chemical substances that are sprayed on human populations in order to manipulate them physically and psychologically.

Bellingcat even found a German language flight tracking tutorial produced by a conspiracy theorist for fellow believers in chemtrails.

A Telegram post that includes a flight tracking tutorial for conspiracy theorists.

Despite appearing to use these tools extensively, QAnon followers often seemed unsure as to how they should apply them to support their claims. Some focused on the shapes created by the flight paths planes take. One German conspiracy theorist shared the below picture depicting the shape of a rabbit which was captured on Flightradar24.

A picture of a rabbit is depicted on Flightradar24

This flight took place when a pilot flew over Berlin to create a rabbit shape just before Easter in April 2020. Despite acknowledging that this was “probably an Easter gag”, the uploader who noted it began their post with the slogan: “Follow the white rabbit.” According to this poster, the rabbit shape was “at least a synchronicity”.

Bellingcat’s Investigative Tech Team also found a dedicated German-language conspiracy theorist community which focuses on interpreting what they call “parallel flights” or “ring flights,” named after the shape of visible routes detailed on flight tracking sites. Often, the community tries to establish a connection between those flights and child abuse, again for reasons that are unclear and that seem lacking in clear logic beyond their existence in Q mythology.

A screen grab of a Telegram post detailing what are said to be “parallel flights.”

Bellingcat came across this community after noticing an increasing number of posts in the Telegram database had been referring to the flight-tracking website globe.adsbexchange.com since the beginning of 2021.

The website globe.adsbexchange.com appeared for the first time in November 2020 in Bellingcat’s Telegram dataset. After peaking for the first time in January 2021 its use in Telegram posts increased even more between March and June 2021.

At that time, a group of German conspiracy theorists appeared to be using the site to try and to keep track of the US Doomsday plane, speculating whether President Trump was on board.

A screen grab of a Telegram post said to be tracking the Doomsday Plane.

From March 2021 onwards, however, the site appeared to be used primarily in a German context. Users shared screenshots of flights they noticed taking place close to where they lived or in regions familiar to them. One Telegram channel, which had more than 15,000 followers at time of publication, regularly shared screenshots of “parallel” or “ring” flights that were visible on globe.adsbexchange.com, a popular flight tracking website.

Example of a “parallel flight” from a Telegram channel.

The channel owner mainly focused on sharing screenshots upon which they rarely commented. They also linked to a comments section where they asked followers to write down their thoughts about the observed flights.

Screenshot of the comments section of the German “flight spotter” community on Telegram.

Screenshot of the comments section of the German “flight spotter” community on Telegram.This forum offered an interesting example of a space where conspiracy theorists and genuine aviation enthusiasts appeared to unwittingly meet. This is likely due to the  channel’s seemingly benign name, attracting flight hobbyists as well as those from the conspiracy community with a newfound interest in flight tracking. It is not entirely clear whether the channel owner is a Q conspiracist  or flight enthusiast, although they do not seem bothered by the fact that QAnon enthusiasts are eager followers and commenters.

One user, for instance, wondered whether “ring” and “parallel flights” close to the locations of newly found World War II bombs in Germany could have something to do with a search for “DUMBS”. QAnon followers believe that “Dumbs” (in the German conspiracy world sometimes also called “dumps”) are “deep underground military bases” in which the “deep state” hides and mistreats children.

In the same comments section, however, another user refutes these conspiracy theories, arguing that aircrafts flying in parallel lines close to World War II bomb sites are likely supporting the work of bomb disposal units. “Ring flights,” according to this commenter, are most probably test flights taken by recently repaired aircraft. Several other users in the comments section also tried to disprove the QAnon conspiracies.

While these interactions may just appear eccentric, they raise more serious questions as to whether individuals unfamiliar with the conspiracy could be unwittingly drawn into them.

Members of German QAnon Telegram channels also complained that planes or helicopters seen in the sky were not visible on tools like Flightradar24. Conclusions, usually misinformed, were then drawn from these observations. In one example found by Bellingcat, a QAnon follower posted that they had observed military helicopters flying over a town near Aachen, close to Germany’s borders with Belgium and the Netherlands. These helicopters were apparently not visible on Flightradar24, so the poster asked whether they may be part of “hidden operations.” As is customary for many posts in Q communities, no evidence was provided for the claim that helicopters were indeed flying at the time specified. Meanwhile, as noted in the “how it works” section of the FlightRadar24 website, not all helicopters do have ADS-B transponders (although some more modern ones do). It is also the case that flight tracking platforms in general don’t have perfect coverage, meaning that they don’t display 100% of the aircraft that are in the air at any given moment. It is therefore very possible that those highlighted would not show up on the platform. Despite this less dramatic explanation for these flights’ absence, the post had been viewed more than 12,000 times.

A Telegram post detailing sightings of helicopters near the Aachen.

Random lines as fake “evidence” for the causes of climate change

QAnon followers in Bellingcat’s dataset appeared to make use of several other types of open source tools to pursue their theories. 

In one example, a post shared widely in QAnon themed Telegram channels combined data from the weather website windy.com and the patent search engine, Google Patents. In doing so, the uploader sought to disprove the existence of climate change. 

As with the vast majority of theories that emanate from the QAnon movement, however, the analysis again lacked logical consistency or evidence that stood up to basic scrutiny.

The user presented plans found on Google Patents for a “hurricane and tornado control device” as proof that weather patterns were being manipulated.

A Screenshot of patent information for a “Hurricane and tornado control device” on Google Patents.

They even produced a video which at one stage zoomed into an image of a typhoon, drawing the audience’s attention to seemingly random line formations visible at the edge of the picture. These lines are described as frequencies, a term used in the patent.

Line formations (highlighted with yellow arrow by Bellingcat) in a conspiracy theory video.

The uploader then implies that because the patent describes how weather could theoretically be manipulated, the device is secretly being used to create meteorological events. The video ends with the narrator asking:  “Who or what is climate change? Is it real? Would it also be there without those frequencies that influence weather systems?”

As with the earlier example of the toy rabbit, the poster provides no evidence as to why their conclusions make sense. Nor do they address why the information contained within the patent is correct, verified or to be trusted. 

It seems they have come to the conclusion — or perhaps rationalised a conviction they already held — that climate change is manipulated purely because they found a defunct patent online then extrapolated from there.

Do QAnon followers consider themselves open source investigators?

The Telegram posts detailed in this article clearly show that Q enthusiasts are far from experts at understanding or employing open source research methods. 

Yet they also seem to be adopting more than just the technical tools used by more competent and trustworthy investigators. 

Some Q followers were observed encouraging others to work together. As Bellingcat has previously explored, the collaborative and crowdsourced nature of QAnon is a key reason for the conspiracy’s success. Collaboration is also a key aspect of open source investigations, with groups of people filtering through large numbers of social media posts or geolocating several videos at once. Crowdsourcing is also common to provide further scale and sift through even more data, videos or analysis at a quicker pace.

One German QAnon channel with approximately 150,000 subscribers begins with a post that says: “We are an open source team, which consists of mostly anonymous, voluntary helpers, where everyone contributes a small part.”

A Telegram post thst uses the term “open source”.

Another German language Telegram channel defined QAnon as a “peaceful, worldwide open source intelligence service movement which is anchored in intellectual sovereignty, research, love of our countries, of humanity and — for most — of God.”

Overall, however, the German language QAnon community does not extensively use the term “open source investigations.” This is not surprising since it is an English language term not widely known in German-speaking countries. The term has also not yet found a common German translation (Bellingcat uses “Open-Source-Recherchen” in German). 

When the phrase open source does show up in Bellingcat’s dataset (447 times), it often refers to German translations of Q drops in which the word “open source” has been kept untranslated. For instance, a German language post about the disgraced socialite Ghislaine Maxwell contains the term “open source” with readers encouraged to “follow the family” — likely a reference encouraging readers to further look into the Maxwells.

A Telegram post encourages readers to look into the family of Ghislaine Maxwell.

More frequently, though, the German-speaking QAnon community simply refers to the verb or noun “research” (which are two separate words in German) to describe what they think they are doing. These terms showed up 11,815 and 2,988 times respectively in Bellingcat’s Telegram database from early 2019 to October 2021. The use of the term “research”  is common in English language Q communities as well. “Do your own research” or “I do my own research” have also become phrases used by those in the anti-vaxx or 5G conspiracy movements.

In a post with the title “What is Q?” one follower described QAnon’s aim as “to create a reason which justifies that you opt for online research and not for the TV broadcast” after a long working day. The poster hoped that through QAnon followers would be “motivated to find out, to learn and to investigate further.” 

Other Telegram posts describe “research” as simply consuming what other QAnon posters produce. For example, a QAnon Telegram poster suggested: “Go to my or one of the other Anon’s Facebook pages, read and digest the things that we say and write. Then you look at the topics you are interested in. That’s how you research and learn.” 

A Telegram post captured by Bellingcat that details how to “research” online.

As with all the examples in this article, however, such advice is not a sound basis for research or investigation, open source or otherwise. 

Satellite Maps, flight tracking websites and publicly available weather monitoring systems can all be harnessed by individuals and researchers for both simple and complex tasks. But they cannot prevent people from a movement known for its baseless conspiracies misinterpreting the information such tools can provide, or employing them to try and support clearly false premises.

The tools, employed in this way, only appear to push Q enthusiasts further down rabbit holes of their own creation. The result is more convoluted, misleading and potentially harmful conspiracies.

In the German context, it has also helped further localise the Q conspiracy.

Editor’s note: Bellingcat has removed some of the links in this article to prevent their spread online. If individual researchers would like to access the posts detailed in this story, please contact the Bellingcat Investigative Tech Team here. 

Bellingcat’s Investigative Tech Team develops tools for open source investigations and explores tech-focused research techniques. Do you have a question about applying these methods or tools to your own research, or an interest in collaborating? Contact us here.

Logan Williams contributed to this story.

This article is supported by a European Union grant that aims to support small-scale online media tackle disinformation and fake news. You can read about the grant here. The European Union support for the production of this publication does not constitute endorsement of the contents which is the responsibility of, and solely reflects the reporting of, the authors.