How a Fringe Theory About Ukraine Took Root in the White House

In an April 2017 interview with The Associated Press, President Trump suddenly began talking about the hack of the Democratic National Committee a year earlier, complaining that the F.B.I. had not physically examined the compromised server.

“They brought in another company that I hear is Ukrainian-based,” the president said.

“CrowdStrike?” the surprised reporter asked, referring to the California cybersecurity company that investigated how Russian government hackers had stolen and leaked Democratic emails, disrupting Hillary Clinton’s campaign.

“That’s what I heard,” Mr. Trump resumed. “I heard it’s owned by a very rich Ukrainian; that’s what I heard.”

More than two years later, Mr. Trump was still holding on to this false conspiracy theory. In his July call with President Volodymyr Zelensky of Ukraine, he summed it up in a sort of shorthand — at least according to the White House memorandum, labeled “not a verbatim transcript.”

“I would like you to find out what happened with this whole situation with Ukraine, they say CrowdStrike … I guess you have one of your wealthy people …,” the president said. It is unclear whether the ellipses indicate that words were omitted or that Mr. Trump’s voice was trailing off.

Then he added one novel detail: “The server, they say Ukraine has it.”

Now, Mr. Trump’s call for Ukraine to look into his CrowdStrike story forms the background to the House impeachment inquiry, which is focused on the second request he made: that Mr. Zelensky investigate Mr. Trump’s possible 2020 opponent, former Vice President Joseph R. Biden Jr. Mr. Trump has placed a concoction of disprovable claims, of the kind usually found on the fringes of the web, squarely in the middle of American politics and diplomacy.

The tale of the supposedly hidden server may have appealed to Mr. Trump because it undercut a well-established fact that he has resented and resisted for three years: The Russian government interfered in the 2016 election to help him win, an effort thoroughly documented by American intelligence agencies and amply supported by public evidence.

By contrast, there is no evidence to support the president’s vague suggestion that Ukraine, not Russia, might be responsible for the hacking, or that CrowdStrike somehow connived in it. But his alternate history has provided a psychological shield for the president against facts that he believes tarnish his electoral victory.

Mr. Trump has long called for better relations with Vladimir V. Putin’s Russia and brushed aside complaints about its conduct. So there is a certain symmetry to his suggestion that Ukraine, Russia’s opponent and the victim of its territorial grab, may somehow have framed Russia for the 2016 election activity.

“Ukraine is the perfect scapegoat for him, because it’s the enemy of Russia,” said Nina Jankowicz, a fellow at the Wilson Center in Washington who regularly visits Ukraine and is writing a book called “How to Lose the Information War.”

She noted that a number of Ukraine-linked stories, some of them distorted or exaggerated, have been pulled together by Mr. Trump’s supporters into a single narrative.

For example, there is the idea, promoted by the president’s lawyer Rudolph W. Giuliani, that Ukraine’s government actively sabotaged Mr. Trump’s 2016 campaign. A Ukrainian-American lawyer who consulted for the D.N.C. looked into the finances of Paul Manafort and spoke with Ukrainian embassy officials. But there appears to have been no organized Ukrainian government effort to intervene — certainly nothing comparable to the activities of Russian intelligence agencies ordered by Mr. Putin.

It is true that a Ukrainian legislator helped publicize documents on Mr. Manafort’s multimillion-dollar payments from a Ukrainian political party, leading to his resignation as Mr. Trump’s campaign chairman. But the claim of Mr. Manafort’s wrongdoing turned out to be justified. He is now serving seven and a half years in prison for financial fraud and other crimes.

In May, Mr. Trump recalled the American ambassador to Kiev, Marie L. Yovanovitch, appointed by President Barack Obama in 2016, telling others she was scheming against his administration. She has denied it.

And Mr. Trump has repeatedly charged that Mr. Biden, who handled Ukrainian affairs as vice president, tried to get a prosecutor fired for investigating a Ukrainian energy company that paid his son, Hunter, handsomely as a board member despite a lack of experience in Ukraine. In fact, multiple countries were pressing for the firing of the prosecutor, who they thought was turning a blind eye to corruption.

“Now it seems like all of these conspiracy theories are merging into one,” Ms. Jankowicz said. She studies disinformation, she said, but Mr. Trump produced one claim she’d never come across.

“I do this for a living, and I’d never heard anyone say the servers were in Ukraine,” she said.

Twitter removed a video posted by Mr. Trump that showed a meme of Nickelbacker’s lead singer, edited as an attack on Joe Biden.

In the 27 months between Mr. Trump’s two citations of the CrowdStrike-Ukraine conspiracy theory, it has survived despite many denials from CrowdStrike, the F.B.I. and people directly involved in the investigations. It has survived despite the fact that the D.N.C. put one of its hacked servers on display — not in Ukraine but in its Washington offices beside the filing cabinet pried open in 1972 by the Watergate burglars (and a photo of the two artifacts ran on The Times’s front page). It has survived despite the indictment prepared last year by Robert S. Mueller III, the special counsel, laying out in extraordinary detail the actions of 12 named Russian military intelligence officers who hacked the D.N.C. and other election targets.

The speculation springs from what Mr. Trump has called a “big Dem scam” — the false notion that the F.B.I. never really investigated the D.N.C. hack. In fact, according to people directly involved, CrowdStrike was in regular contact with the bureau in spring 2016 as it examined dozens of servers used by both the D.N.C. and the Democratic Congressional Campaign Committee.

It is true, as Mr. Trump has often tweeted, that F.B.I. agents never took physical possession of the Democrats’ servers. But CrowdStrike supplied the F.B.I. with digital copies of the servers so that the bureau could assess the Russian malware infecting them. The Mueller investigation later confirmed CrowdStrike’s findings.

Still, the president has clung to the theory linking CrowdStrike, Ukraine and the D.N.C. servers despite the repeated efforts of his aides to dissuade him, Thomas Bossert, his former homeland security adviser, said on Sunday on ABC’s “This Week.” “The D.N.C. server and that conspiracy theory has got to go,” he said. “If he continues to focus on that white whale, it’s going to bring him down.”

To go in search of the roots of Mr. Trump’s CrowdStrike-Ukraine conspiracy theory is to travel the internet’s most peculiar provinces and the darkest threads on Twitter and Facebook. On 4chan and pro-Trump spaces on Reddit, on websites like ZeroHedge.com and Washington’s Blog, you can find plenty of speculation about evil manipulation by CrowdStrike and secret maneuvers by Ukrainians — often inflamed by Mr. Trump’s own statements.

Until the president’s statements, however, even internet speculation did not attribute CrowdStrike’s ownership to a rich Ukrainian or suggest that the D.N.C. servers were hidden in Ukraine.

George Eliason, an American journalist who lives in eastern Ukraine, where pro-Russian separatists fought Ukrainian forces, has written extensively about what he considers to be a “coup attempt” against President Trump involving American and Ukrainian intelligence agencies and CrowdStrike. He said he did not know if his writings for obscure websites might have influenced the president.

“CrowdStrike and Ukrainian Intel are working hand in glove,” he wrote in an email. “Is Ukrainian Intelligence trying to invent a reason for the U.S. to take a hardline stance against Russia? Are they using CrowdStrike to carry this out?”

Mr. Eliason and other purveyors of Ukraine conspiracies often point to the Atlantic Council, a research group in Washington, as the locus of the schemes. The Ukrainian oligarch Viktor Pinchuk has made donations to the council and serves on its international advisory board; Dmitri Alperovitch, CrowdStrike’s co-founder, who was born in Russia and came to the United States as a child, is an Atlantic Council senior fellow.

That connection seems slender, but it may be the origin of Mr. Trump’s association of a wealthy Ukrainian with CrowdStrike.

Pro-Trump media leaped last week to defend the president’s Ukraine theories. Rush Limbaugh said on his radio show that Mr. Trump’s “reference to CrowdStrike, mark my words, is momentous,” though he did not say why.

And Russian state news outlets are always ready to cheer on Mr. Trump’s efforts to point the blame for the 2016 hack away from Moscow. On Sept. 25, after the White House released its memo on the Zelensky call, Russia’s Sputnik news website ran a story supporting Mr. Trump’s remarks.

The Sputnik article cited Mr. Eliason’s writings and suggested that CrowdStrike might have framed Russia for the D.N.C. hack — if it occurred at all. It quoted a Twitter account called “The Last Refuge” declaring: “The D.N.C. servers were never hacked.”

All this mythmaking about the 2016 hack frustrates Robert Johnston, who was the lead investigator for CrowdStrike on the D.N.C. inquiry. Mr. Johnston, a former Marine and Cyber Command operator, said he could make no sense of Mr. Trump’s assertions.

“It doesn’t connect with anything in my experience,” he said. “I’d be interested in the president of Ukraine’s impression.”

Mr. Johnston, now chief executive of the cybersecurity company Adlumin, said he was weary of the conspiracies surrounding what he considered a straightforward conclusion. Having seen the digital fingerprints of Russian intelligence in earlier hacking cases, he felt there was little doubt about the identity of the perpetrators.

“I don’t know how you get to this point,” Mr. Johnston said of the fantasies Mr. Trump has promoted. “This is a story that just won’t die.”