DISARM Framework & Q Operation: Connection Analysis
DISARM Framework & Q Operation: Connection Analysis
OPUS INVESTIGATION REPORT
DISARM Framework & Q Operation: Connection Analysis
Investigation ID: OPUS-2026-0119-DISARM-Q
Date: January 19, 2026
Classification: UNCLASSIFIED // FOR PUBLIC RELEASE
Investigator: OPUS - Project Milk Carton Autonomous Intelligence
EXECUTIVE SUMMARY
This investigation analyzed the relationship between the DISARM Framework (2018-2024) and the Q operation (2017-2022) to determine whether meaningful connections exist between them. Following the evidence through multiple phases of research, this investigation reaches the following conclusions:
KEY FINDINGS
| Question | Finding | Confidence |
|---|---|---|
| Did DISARM study Q? | Likely YES - DISARM was built to analyze operations like Q | HIGH |
| Could DISARM have been used to design Q? | NO - Timeline doesn't support; Q predates DISARM | HIGH |
| Are DISARM creators connected to Q? | NO EVIDENCE - No direct connections found | HIGH |
| Do Q's TTPs match DISARM's framework? | Expected - Q is the type of operation DISARM was designed to analyze | MEDIUM |
| Did DISARM-connected orgs benefit from Q's damage? | NO EVIDENCE - No overlap found | HIGH |
BOTTOM LINE
The most likely explanation is Option A: DISARM was created BY studying operations like Q as case studies (defensive response).
The timeline is clear:
- Q started: October 28, 2017
- DISARM precursor (hybrid warfare workshop): Summer 2018
- AMITT framework created: December 2018
- DISARM Foundation: Late 2021
There is NO evidence that DISARM was used to design Q. Q predates DISARM by over a year, and the forensic linguistic evidence points to Q being authored by Paul Furber and later Ron Watkins - neither of whom have any connection to DISARM creators.
PHASE 1: ORGANIZATIONAL ANALYSIS
DISARM Foundation Structure
UK Entity (Current):
- Company: DISARM Foundation C.I.C.
- Company Number: 15833044
- Incorporated: July 11, 2024
- Type: Community Interest Company (nonprofit)
- Address: Unit 3, Office A, 1st Floor, 6-7 St Mary At Hill, London, EC3R 8EE
Directors:
1. Jonathan Peter Brewer - Born December 1964, British, appointed July 2024
2. Stephen Hugh Campbell - Born April 1961, British, appointed August 2025
3. Victoria Mary Elizabeth Smith - Born September 1982, British, appointed August 2025
US Entity (Original):
- Location: Hopkinton, Massachusetts
- Tax ID: 87-1146271
- Status: 501(c)(3) tax-exempt
- Founded: September 2021
Funding Sources:
- Craig Newmark Philanthropies (primary funder since 2019)
- Alfred Landecker Foundation (via Alliance4Europe, 2022-2024)
- Public Democracy America
- Alliance4Europe
Source: UK Companies House
Organizational Network Map
CRAIG NEWMARK PHILANTHROPIES
|
(funding since 2019)
|
+-------------------------+-------------------------+
| | |
v v v
DISARM FOUNDATION STANFORD INTERNET OBS. EFF / OTHER CYBERSEC
|
+------- Alliance4Europe (EU support)
|
+------- Global Cyber Alliance (personnel overlap - Jon Brewer)
|
+------- MITRE Corporation (framework collaboration)
|
+------- Florida International University (academic partner)
Key Network Findings:
- NO connections found to 8chan/8kun or Jim Watkins
- NO connections found to VOLAGs or refugee resettlement organizations
- NO connections found to child welfare organizations damaged by Q
- NO connections found to Q-related platforms or promoters
PHASE 2: PERSONNEL INVESTIGATION
Jon Brewer (DISARM Executive Director)
Background:
- Born: December 1964
- Nationality: British
- Education: MA Marketing, Kingston University (1991-1992)
- Previous Role: Development Director, Global Cyber Alliance (3 years)
- Career: UK public sector, NGOs, social enterprises, B2B tech
Intelligence/Military Connections: NONE FOUND
Q-related Connections: NONE FOUND
VOLAG Connections: NONE FOUND
Source: DISARM Foundation About
Dr. Pablo Breuer (DISARM Board Chair, Design Authority)
Background:
- 22-year US Navy veteran
- Military Director, US SOCOM Donovan Group
- Senior Military Advisor, SOFWERX
- Global Network Exploitation and Vulnerability Analyst (GNEVA), NSA (2003-2008)
- Chief of Advanced Threats Branch, US Cyber Command (2011-2014)
- Current: Executive Director, Morgan Stanley (Security)
- Non-resident Senior Fellow, Atlantic Council GeoTech Center
Education:
- BS Computer Science, US Naval Academy
- Naval Postgraduate School (2006-2008, 2016-2020)
- US Naval War College (2006-2008)
Intelligence/Military Connections: EXTENSIVE (NSA, CYBERCOM, SOCOM)
Q-related Connections: NONE FOUND
VOLAG Connections: NONE FOUND
FEC Contributions: NONE FOUND in database
Analysis: Breuer has extensive intelligence community background, but his focus was cybersecurity and offensive cyber operations - NOT psychological operations or information warfare in the Q-style sense. No evidence he had any role in Q's creation.
Source: Atlantic Council, Stimson Center
Sara-Jayne Terp (SJ Terp, AMITT Creator, Design Authority)
Background:
- Data scientist with background in unmanned vehicle systems, transport, intelligence, disaster data
- Former CTO, UN Global Pulse (UN's big data team)
- Adjunct Professor, Columbia University (Data Science for Development)
- Founder, Bodacea Light Industries
- Co-founder, CogSec Collaborative
- Co-founder, ThreeT Consulting
- Senior Fellow, Atlantic Council
- Advisor, Centre for Epistemic Security
Education:
- Master's in Artificial Intelligence
- Master's in Pattern Analysis and Neural Networks
Controversy:
- Named in CTIL Files whistleblower allegations (2023)
- Allegations: Developed AMITT framework used for censorship purposes
- CTI League response: Denied censorship was the goal; released all files
Intelligence/Military Connections: Described as "former UK defense researcher" in whistleblower documents
Q-related Connections: NONE FOUND
VOLAG Connections: NONE FOUND
Source: Stimson Center, CXOTalk
Craig Newmark (Primary Funder)
Background:
- Born: December 6, 1952
- Founder: Craigslist
- Founded Craig Newmark Philanthropies: 2015
- Net worth: Previously $1.3B (2020), reduced due to giving
- Total giving: ~$450 million committed
Philanthropic Focus:
- Trustworthy journalism (~$200M since 2016)
- Cybersecurity ($100M+ pledge)
- Veterans and military families
- Voter protection
- Women in technology
Key Grants Related to Disinformation:
- Stanford Internet Observatory: $5 million
- Electronic Frontier Foundation: $200,000 (2024)
- Global Cyber Alliance: $1 million
- Consumer Reports Digital Lab: $6 million
- DISARM/AMITT: Funded since 2019 (amount not disclosed)
Intelligence Connections: NONE FOUND
Q-related Connections: NONE FOUND
VOLAG Connections: NONE FOUND
FEC Contributions: Not found in recent cycles
Source: Wikipedia, Inside Philanthropy
PHASE 3: TIMELINE ANALYSIS
Critical Timeline Comparison
Q OPERATION TIMELINE DISARM/AMITT TIMELINE
===================== =====================
Oct 28, 2017 - First Q post on 4chan
|
Jan 2018 - Q moves to 8chan
| Summer 2018 - Hybrid warfare workshop
| (DISARM genesis)
|
| Dec 2018 - AMITT Red Framework started
|
| Jan 2019 - MisinfosecWG launched
|
| May 2019 - AMITT framework created
| at CredConX Atlanta
|
| Nov 2019 - AMITT Blue Framework started
|
| 2020 - CogSec Collaborative formed
| - CTI League uses AMITT for COVID
|
Nov 13, 2020 - Final sustained Q posts
| Late 2021 - DISARM Foundation created
| (name change from AMITT)
|
Nov 2022 - Final Q posts (4963-4966) 2022 - MITRE/FIU merge AMITT + SP!CE
into DISARM
July 2024 - UK DISARM Foundation C.I.C.
Timeline Conclusion
Q predates DISARM by over a year.
- Q's first post: October 28, 2017
- DISARM precursor workshop: Summer 2018
- AMITT framework: December 2018 - May 2019
This timeline makes it impossible for DISARM to have been used to design Q. The framework didn't exist when Q started.
PHASE 4: FRAMEWORK ANALYSIS
Was DISARM Built BY Studying Q?
Answer: Almost certainly YES.
The DISARM framework was explicitly designed to analyze disinformation operations. Q is one of the most documented and analyzed disinformation operations in history. It would be surprising if DISARM creators did NOT study Q.
Evidence:
1. DISARM was created at a "hybrid warfare workshop" in summer 2018 - when Q was already a major phenomenon
2. DISARM founders (Terp, Breuer) are disinformation researchers - Q was the biggest disinformation story of 2018-2020
3. DISARM was used by CTI League for COVID disinformation response (2020) - Q was heavily promoting COVID conspiracies at this time
4. The framework's Red Team TTPs match exactly the types of techniques Q used
However, no direct evidence found that DISARM explicitly documented Q as a case study. The Russian IRA's 2016 election interference is more commonly cited as a documented DISARM/AMITT case study.
Could DISARM Have Been Used TO Design Q?
Answer: NO - Timeline doesn't support this.
For DISARM to have been used to design Q:
- DISARM would need to exist before October 2017
- DISARM creators would need connection to Q operators
Neither condition is met:
1. DISARM didn't exist until 2018-2019
2. No evidence connects DISARM creators to Paul Furber, Ron Watkins, or Jim Watkins
Why Do Q's TTPs Match DISARM So Closely?
Because DISARM was designed to catalog operations like Q.
DISARM's 16 tactics include:
- Plan Strategy
- Plan Objectives
- Develop Narratives
- Select Channels and Affordances
- Establish Assets
- Develop Content
- Establish Legitimacy
- Maximize Exposure
- Drive Online Harms
- Drive Offline Activity
- Persist in the Information Environment
- Assess Effectiveness
Q demonstrably used all of these tactics. But this doesn't indicate DISARM designed Q - it indicates DISARM correctly identified the tactics that disinformation operations use.
Analogy: The MITRE ATT&CK framework catalogs cyberattack techniques. A sophisticated malware using ATT&CK techniques doesn't mean MITRE designed the malware - it means MITRE correctly documented how attacks work.
PHASE 5: Q OPERATION ANALYSIS
Who Created Q? (Forensic Evidence)
Two independent forensic linguistic analyses identified:
Phase 1 (October - December 2017):
- Primary author: Paul Furber (South African software developer, 4chan moderator)
- Accuracy: 98% confidence (French team)
Phase 2 (January 2018 - November 2020):
- Primary author: Ron Watkins (8chan/8kun administrator)
- Accuracy: 99% confidence (French team)
Key Evidence:
- Stylometric analysis by OrphAnalytics (Swiss)
- Machine learning analysis by Cafiero and Camps (French)
- Both analyses independently reached same conclusion
- Accuracy rates: 93-99%
Source: New York Times investigation, OrphAnalytics
Foreign Amplification (Not Creation)
Evidence of foreign state amplification:
- Russian-backed social media promoted Q as early as November-December 2017
- RT and Sputnik amplified Q since 2019
- 1/5 of QAnon posts (Jan 2020 - Feb 2021) originated from foreign countries (Russia, China)
Important distinction: Amplification ≠ Creation. Foreign actors exploited Q after it existed; they did not create it.
PHASE 6: CHILD WELFARE IMPACT ANALYSIS
Organizations Damaged by Q
| Organization | Damage Type | Source |
|---|---|---|
| Polaris Project | Staff doxxed, death threats, cyberattacks on hotline, false accusations | Polaris Report |
| Save the Children | Hashtag hijacked (#SaveTheChildren), brand damage | Media Manipulation Casebook |
| NCMEC | False accusations, harassment | Multiple sources |
| National Human Trafficking Hotline | Flooded with conspiracy-based calls, diverted from real victims | Polaris Q&A |
Did DISARM-Connected Organizations Benefit?
NO EVIDENCE FOUND.
I checked for connections between:
- DISARM Foundation → Polaris: NONE
- DISARM Foundation → Save the Children: NONE
- DISARM Foundation → NCMEC: NONE
- Craig Newmark Philanthropies → VOLAGs: NONE (focus is journalism/cybersecurity)
- Pablo Breuer → child welfare orgs: NONE
- Sara-Jayne Terp → child welfare orgs: NONE
Conclusion: There is no evidence that anyone connected to DISARM benefited from Q's damage to child welfare organizations.
PHASE 7: CONTROVERSY ANALYSIS
CTIL Files Allegations (2023)
Allegations (Shellenberger, Taibbi, Gutentag):
- CTIL (Cyber Threat Intelligence League) was a government-connected censorship operation
- Sara-Jayne Terp developed AMITT framework used for censorship
- CTIL tracked anti-lockdown content and reported it to government
- 12-20 CTIL members worked at FBI or CISA
CTI League Response:
- Released all files publicly
- Stated disinformation was "tiny fraction" of work
- Denied government directed their activities
- Said CISA/FBI were "guests" who joined after founding
- Noted death threats against named individuals
Independent Assessment:
The CTIL controversy relates to:
- Whether DISARM/AMITT was used for censorship during COVID
- Whether government agencies directed CTI League activities
It does NOT relate to:
- Q's creation (predates CTI League by 3 years)
- Child welfare organizations
- DISARM being used to design Q
EVIDENCE SUMMARY
What We Know (High Confidence)
- Q was created by Paul Furber and Ron Watkins (forensic linguistic evidence)
- Q started October 2017; DISARM started 2018 (timeline documented)
- DISARM was designed to analyze disinformation operations (stated purpose)
- Q damaged child welfare organizations (documented by Polaris, etc.)
- No DISARM personnel have connections to Q creators (OSINT investigation)
- Craig Newmark focuses on journalism/cybersecurity, not VOLAGs (grant records)
What Remains Unknown
- Whether DISARM creators explicitly documented Q as a case study (likely but not confirmed)
- Full extent of government involvement in CTI League activities
- Whether any indirect connections exist through extended networks
What We Can Rule Out
- ❌ DISARM was used to design Q (timeline impossible)
- ❌ DISARM creators operated Q (no evidence, forensics point elsewhere)
- ❌ DISARM-connected orgs benefited from Q's damage (no connections found)
- ❌ Craig Newmark funds VOLAGs (focus areas don't match)
CONCLUSIONS
Primary Finding
The relationship between DISARM and Q is that of analyst and subject, not creator and creation.
DISARM is a framework for analyzing disinformation operations. Q is a disinformation operation. DISARM would naturally study Q as part of its mission - but the timeline makes it impossible for DISARM to have designed Q.
Why Q's TTPs Match DISARM
This is expected, not suspicious. If DISARM correctly documents how disinformation operations work, then any sophisticated disinformation operation (including Q) would match the framework. This validates DISARM's accuracy, not its involvement.
On the "15 of 16 Tactics" Claim
If Q matches 15 of 16 DISARM tactics, this indicates:
1. Q was a sophisticated disinformation operation (known)
2. DISARM correctly identifies disinformation tactics (expected)
3. NOT that DISARM designed Q (timeline impossible)
Remaining Questions
- Why haven't DISARM creators publicly analyzed Q using their framework? This would be useful for the research community.
- What specific disinformation operations did DISARM explicitly study during development? Russian IRA is cited; Q is not.
- How did Q's creators learn these tactics? Chan culture, previous operations, or self-development? This remains an open question unrelated to DISARM.
SOURCES
Primary Sources
- UK Companies House - DISARM Foundation
- DISARM Foundation Official Website
- DISARM Brief History
- Polaris Project QAnon Report
- OrphAnalytics Q Stylometry Study
Personnel Sources
Framework Sources
Q Analysis Sources
- Bellingcat - Making of QAnon
- NBC News - Three People Who Popularized Q
- New York Times - Q Forensic Analysis
Controversy Sources
TOOLS USED
| Tool | Purpose | Results |
|---|---|---|
| WebSearch | Organizational research | 25+ queries |
| WebFetch | UK Companies House, DISARM history | 3 pages |
| ORACLE money_trail | Craig Newmark, Global Cyber Alliance grants | No relevant records |
| ORACLE fec_search | Pablo Breuer, Craig Newmark contributions | No contributions found |
| Kali OSINT: whois | disarm.foundation, cogsec-collab.org domains | Registration dates confirmed |
| Kali OSINT: sherlock | Personnel usernames | Timeouts (low priority) |
Report Generated: January 19, 2026
Investigator: OPUS - Project Milk Carton Autonomous Intelligence
Classification: UNCLASSIFIED // FOR PUBLIC RELEASE
This investigation followed evidence wherever it led, including to the conclusion "no connection found" for several questions. Truth-seeking requires accepting null results when evidence doesn't support a hypothesis.
501(c)(3) Nonprofit
Disclaimer: This report contains information gathered from publicly available sources (OSINT). All findings should be independently verified. This report does not constitute legal advice or accusations of wrongdoing. Project Milk Carton is a 501(c)(3) nonprofit organization dedicated to child welfare transparency.
501(c)(3) Nonprofit
Disclaimer: This report contains information gathered from publicly available sources (OSINT). All findings should be independently verified. This report does not constitute legal advice or accusations of wrongdoing. Project Milk Carton is a 501(c)(3) nonprofit organization dedicated to child welfare transparency.