In an April 2017 interview with The Associated Press, President Donald Trump suddenly began talking about the hack of the Democratic National Committee a year earlier, complaining that the FBI had not physically examined the compromised server.
“They brought in another company that I hear is Ukrainian-based,” the president said.
“CrowdStrike?” the surprised reporter asked, referring to the California cybersecurity company that investigated how Russian government hackers had stolen and leaked Democratic emails, disrupting Hillary Clinton’s campaign.
“That’s what I heard,” Trump resumed. “I heard it’s owned by a very rich Ukrainian; that’s what I heard.”
More than two years later, Trump was still holding on to this false conspiracy theory. In his July call with President Volodymyr Zelenskiy of Ukraine, he summed it up in a sort of shorthand — at least according to the White House memorandum, labeled “not a verbatim transcript.”
“I would like you to find out what happened with this whole situation with Ukraine, they say CrowdStrike … I guess you have one of your wealthy people …,” the president said. It is unclear whether the ellipses indicate that words were omitted or that Trump’s voice was trailing off.
Then he added one novel detail: “The server, they say Ukraine has it.”
Now, Trump’s call for Ukraine to look into his CrowdStrike story forms the background to the House impeachment inquiry, which is focused on the second request he made: that Zelenskiy investigate Trump’s possible 2020 opponent, former Vice President Joe Biden. Trump has placed a concoction of disprovable claims, of the kind usually found on the fringes of the web, squarely in the middle of American politics and diplomacy.
The tale of the supposedly hidden server may have appealed to Trump because it undercut a well-established fact that he has resented and resisted for three years: The Russian government interfered in the 2016 election to help him win, an effort thoroughly documented by American intelligence agencies and amply supported by public evidence.
By contrast, there is no evidence to support the president’s vague suggestion that Ukraine, not Russia, might be responsible for the hacking, or that CrowdStrike somehow connived in it. But his alternate history has provided a psychological shield for the president against facts that he believes tarnish his electoral victory.
Trump has long called for better relations with Vladimir Putin’s Russia and brushed aside complaints about its conduct. So there is a certain symmetry to his suggestion that Ukraine, Russia’s opponent and the victim of its territorial grab, may somehow have framed Russia for the 2016 election activity.
“Ukraine is the perfect scapegoat for him, because it’s the enemy of Russia,” said Nina Jankowicz, a fellow at the Wilson Center in Washington who regularly visits Ukraine and is writing a book called “How to Lose the Information War.”
She noted that a number of Ukraine-linked stories, some of them distorted or exaggerated, have been pulled together by Trump’s supporters into a single narrative.
For example, there is the idea, promoted by the president’s lawyer Rudy Giuliani, that Ukraine’s government actively sabotaged Trump’s 2016 campaign. A Ukrainian-American lawyer who consulted for the DNC looked into the finances of Paul Manafort and spoke with Ukrainian embassy officials. But there appears to have been no organized Ukrainian government effort to intervene — certainly nothing comparable to the activities of Russian intelligence agencies ordered by Putin.
It is true that a Ukrainian legislator helped publicize documents on Manafort’s multimillion-dollar payments from a Ukrainian political party, leading to his resignation as Trump’s campaign chairman. But the claim of Manafort’s wrongdoing turned out to be justified. He is now serving seven and a half years in prison for financial fraud and other crimes.
In May, Trump recalled the American ambassador to Kyiv, Marie Yovanovitch, appointed by President Barack Obama in 2016, telling others she was scheming against his administration. She has denied it.
And Trump has repeatedly charged that Biden, who handled Ukrainian affairs as vice president, tried to get a prosecutor fired for investigating a Ukrainian energy company that paid his son, Hunter, handsomely as a board member despite a lack of experience in Ukraine. In fact, multiple countries were pressing for the firing of the prosecutor, who they thought was turning a blind eye to corruption.
“Now it seems like all of these conspiracy theories are merging into one,” Jankowicz said. She studies disinformation, she said, but Trump produced one claim she’d never come across.
“I do this for a living, and I’d never heard anyone say the servers were in Ukraine,” she said.
In the 27 months between Trump’s two citations of the CrowdStrike-Ukraine conspiracy theory, it has survived despite many denials from CrowdStrike, the FBI and people directly involved in the investigations. It has survived despite the fact that the DNC put one of its hacked servers on display — not in Ukraine but in its Washington offices beside the filing cabinet pried open in 1972 by the Watergate burglars (and a photo of the two artifacts ran on The Times’s front page). It has survived despite the indictment prepared last year by Robert Mueller, the special counsel, laying out in extraordinary detail the actions of 12 named Russian military intelligence officers who hacked the DNC and other election targets.
The speculation springs from what Trump has called a “big Dem scam” — the false notion that the FBI never really investigated the DNC hack. In fact, according to people directly involved, CrowdStrike was in regular contact with the bureau in spring 2016 as it examined dozens of servers used by both the DNC and the Democratic Congressional Campaign Committee.
It is true, as Trump has often tweeted, that FBI agents never took physical possession of the Democrats’ servers. But CrowdStrike supplied the FBI with digital copies of the servers so that the bureau could assess the Russian malware infecting them. The Mueller investigation later confirmed CrowdStrike’s findings.
Still, the president has clung to the theory linking CrowdStrike, Ukraine and the DNC servers despite the repeated efforts of his aides to dissuade him, Thomas Bossert, his former homeland security adviser, said on Sunday on ABC’s “This Week.” “The DNC server and that conspiracy theory has got to go,” he said. “If he continues to focus on that white whale, it’s going to bring him down.”
To go in search of the roots of Trump’s CrowdStrike-Ukraine conspiracy theory is to travel the internet’s most peculiar provinces and the darkest threads on Twitter and Facebook. On 4chan and pro-Trump spaces on Reddit, on websites like ZeroHedge.com and Washington’s Blog, you can find plenty of speculation about evil manipulation by CrowdStrike and secret maneuvers by Ukrainians — often inflamed by Trump’s own statements.
Until the president’s statements, however, even internet speculation did not attribute CrowdStrike’s ownership to a rich Ukrainian or suggest that the DNC servers were hidden in Ukraine.
George Eliason, an American journalist who lives in eastern Ukraine where pro-Russian separatists fought Ukrainian forces, has written extensively about what he considers to be a “coup attempt” against Trump involving American and Ukrainian intelligence agencies and CrowdStrike. He said he did not know if his writings for obscure websites might have influenced the president.
“CrowdStrike and Ukrainian Intel are working hand in glove,” he wrote in an email. “Is Ukrainian Intelligence trying to invent a reason for the U.S. to take a hard line stance against Russia? Are they using CrowdStrike to carry this out?”
Eliason and other purveyors of Ukraine conspiracies often point to the Atlantic Council, a research group in Washington, as the locus of the schemes. The Ukrainian oligarch Viktor Pinchuk has made donations to the council and serves on its international advisory board; Dmitri Alperovitch, CrowdStrike’s co-founder, who was born in Russia and came to the United States as a child, is an Atlantic Council senior fellow.
That connection seems slender, but it may be the origin of Trump’s association of a wealthy Ukrainian with CrowdStrike.
Pro-Trump media leaped last week to defend the president’s Ukraine theories. Rush Limbaugh said on his radio show that Trump’s “reference to CrowdStrike, mark my words, is momentous,” though he did not say why.
And Russian state news outlets are always ready to cheer on Trump’s efforts to point the blame for the 2016 hack away from Moscow. On Sept. 25, after the White House released its memo on the Zelenskiy call, Russia’s Sputnik news website ran a story supporting Trump’s remarks.
The Sputnik article cited Eliason’s writings and suggested that CrowdStrike might have framed Russia for the DNC hack — if it occurred at all. It quoted a Twitter account called “The Last Refuge” declaring: “The DNC servers were never hacked.”
All this mythmaking about the 2016 hack frustrates Robert Johnston, who was the lead investigator for CrowdStrike on the DNC inquiry. Johnston, a former Marine and Cyber Command operator, said he could make no sense of Trump’s assertions.
“It doesn’t connect with anything in my experience,” he said. “I’d be interested in the president of Ukraine’s impression.”
Johnston, now chief executive of the cybersecurity company Adlumin, said he was weary of the conspiracies surrounding what he considered a straightforward conclusion. Having seen the digital fingerprints of Russian intelligence in earlier hacking cases, he felt there was little doubt about the identity of the perpetrators.
“I don’t know how you get to this point,” Johnston said of the fantasies Trump has promoted. “This is a story that just won’t die.”
This article originally appeared in The New York Times.
© 2019 The New York Times Company