Who’s Really to Blame for the ‘Ukraine Did It’ Conspiracy Theory?

In her eloquent impeachment testimony last month, Fiona Hill, a recently departed official at the National Security Council, criticized President Donald Trump and his supporters for parroting that Ukraine, not Russia, interfered in the 2016 elections. “This is a fictional narrative that has been perpetrated and propagated by the Russian security services themselves,” Hill said on November 21. The next day, The New York Times reported that senior intelligence officials had briefed senators that Russia, “starting at least in 2017,” had tried to frame Ukraine for interfering in the 2016 election.

Within days, the narrative that Russia framed Ukraine became conventional wisdom among leading journalists and commentators in Washington, D.C. “This ‘it was Ukraine narrative’ may go down in history as the most successful disinformation campaign by the Russian intelligence agencies,” wrote Alina Polyakova of the Brookings Institution, in response to Republican Senator John Kennedy calling into question that Russia hacked the DNC on Fox News. The Washington Post’s Shane Harris, one of the nation’s most respected national-security reporters, reminded Kennedy that the U.S. “has intelligence, which members of Congress have access to, that the Ukraine-did-it story was concocted and peddled by Russia.”

Perhaps the CIA or NSA has indeed assessed—informed by secret intelligence, with high confidence—that Russia planted the idea in Trump’s mind that Ukraine interfered in his election, and that the Kremlin thus triggered a history-making impeachment vote. It’s hard to know what we don’t know. But neither Fiona Hill nor the Times offered the concrete details, direct quotes, or names that would ordinarily back up such a grave claim.

Disinformation campaigns are almost always designed for publicity, and therefore leave public traces. Judging solely on the basis of publicly available evidence, the fictional narrative about Ukraine was concocted and propagated first and foremost by American conspiracy theorists, not Russian disinformation puppeteers.

Related: To Fight Disinformation, Rethink Counterintelligence

Related: Ukraine’s Election Is an All-Out Disinformation Battle

Related: The Magpies and the Cuckoos: A Disinformation Fable

The conspiracy theory that “Ukraine did it” comes in three progressively more extreme versions, and each time the “it” that Ukraine “did” is different. The first version is that Ukraine interfered in the 2016 election on behalf of Hillary Clinton; the second version is that somebody in Ukraine, not Russia, hacked Democratic computer networks in 2016; and the final version is that CrowdStrike, the security firm that helped the DNC, somehow is “Ukrainian-based” or “owned,” and that the DNC server is in Ukraine. (For the record: CrowdStrike was never based in Ukraine, or owned by anybody Ukrainian, and one physical DNC server never existed, because the infrastructure in question was cloud-based.) I’ll refer to those three theories as Ukraine-interfered, Ukraine-hacked, and Ukraine-owned.

Trump, since at least April 2017, subscribes to a mix of all these Ukraine conspiracy theories, as suggested by the summary of his July 25, 2019, call to Ukrainian President Volodymyr Zelensky, and by his 53-minute conversation with Fox & Friends on November 22.

So when and how did these three layers of conspiracy theories emerge?

The Ukraine-interfered narrative originated, legitimately, in Ukraine itself. By the end of May 2016, the paper Ukrayinska Pravda reported on the so-called black ledger, a 22-page document that revealed corruption under Viktor Yanukovych, a former pro-Russian president of Ukraine. On August 14, 2016, the Times broke the story that the handwritten ledger listed Paul Manafort, then Trump’s campaign manager, as the recipient of $12.7 million in undisclosed cash payments from Ukraine’s pro-Russian political party. Less than a week later, Manafort resigned. Another week later, on August 28, a Financial Times headline read: “Ukraine’s Leaders Campaign Against ‘Pro-Putin’ Trump”; the piece argued that Ukrainian politicians were “intervening” in a U.S. election. Trump’s confidant Roger Stone read the FT piece, republished it on his personal website, and shared it on September 6 with his then 79,000 followers on Twitter—an entire month before the John Podesta leaks even started. “The only interference in the US election is from Hillary’s friends in Ukraine,” Stone said. The Ukraine-interfered idea further gained steam in early 2017, thanks to a now-infamous Politico investigation, which was circulated, in turn, by the far right.

Russian disinformation actors active in the 2016 campaign, including both the Internet Research Agency (IRA) in St. Petersburg and Military Intelligence in Moscow (GRU), indeed boosted the Ukraine-interfered narrative. But they did so rather late in the game, about half a year after it had first appeared, IRA activity released by Twitter shows. “Where’s the outrage over Clinton and her campaign team’s collusion with Ukraine to interfere in the US election?” tweeted @USA_Gunslinger on July 13, 2017, one of the IRA’s main fake-conservative accounts. None of the IRA’s Facebook ads mention Ukraine. One known GRU front, CyberBerkut, attempted to promote the Ukraine-interfered narrative with a blog post in June 2017. It would appear that Russian actors did not “concoct” this version of the theory; they parroted the American far right.

The Ukraine-hacked narrative has a murkier origin story. In a document release last month, the FBI revealed one notable detail: During an interview with the FBI, Rick Gates, Manafort’s former deputy, recalled that Konstantin Kilimnik, one of Manafort’s business partners with alleged links to Russian intelligence, advanced the narrative that Ukraine had a role in the DNC hack. “Gates recalled Manafort saying the hack was likely carried out by the Ukrainians, not the Russians, which parroted a narrative Kilimnik often supported,” according to an FBI document, which then adds, confusingly, that “Kilimnik also opined the hack could have been perpetrated by Russian operatives in Ukraine.” It is unclear from Gates’s recollection when exactly this statement was made, and how persistently Manafort in turn repeated it.

The Ukraine-hacked conspiracy theory is usually combined with a version of the CrowdStrike conspiracy theory, in which the cybersecurity firm somehow engineered the DNC leak while framing Russian intelligence. Kilimnik, notably, does not appear to have advanced this far more common version of the theory.

Of all the Ukraine conspiracy theories, the Ukraine-owned narrative received the most attention early on. It appears to have originated in the first days of January 2017, both on the far right and the far left, almost at the same time—in response to a Ukraine-related Department of Homeland Security intelligence release and a Ukraine-related CrowdStrike report from late December.

In the wee hours of January 3, Washington’s Blog, a popular but now defunct alt-right site, ran a rambling, 5,600-word piece titled: “Why Crowdstrike’s Russian Hacking Story Fell Apart.” The piece quoted a litany of rumors, and then homed in on Dmitri Alperovitch, a founder of CrowdStrike: “He isn’t serving US interests. He’s definitely a Ukrainian patriot. Maybe he should move to Ukraine.”

That same day, The Nation published its own article focused on CrowdStrike. The magazine pointed out that Alperovitch is a senior fellow at the Atlantic Council, and that the D.C. think tank was funded in part by “the Ukrainian World Congress, and the Ukrainian oligarch Victor Pinchuk,” thus insinuating that CrowdStrike was somehow linked to Ukrainian money and secret influence. Washington’s Blog picked up the Pinchuk allegation two days later, and Breitbart News also started looking into CrowdStrike.

Known Russian disinformation outlets neither engineered the Ukrainian-owned theory, nor did they amplify it effectively. CyberBerkut never mentioned CrowdStrike, despite pushing the Ukraine-interfered narrative. I analyzed more than 10 million IRA tweets, and found that fewer than 100 mention CrowdStrike. Out of those, only one alludes to “ties” to a Ukrainian billionaire—and that post was late, from March 2017, and simply retweeted a U.S. account that was linking to U.S. content.

Context is crucial here. The GRU, the most important disinformation agent in 2016, came up with an early counterclaim to CrowdStrike’s correct revelation that Russian military intelligence had hacked the DNC: the Guccifer 2.0 persona claimed, in an expletive-laden post seemingly written in haste, that a Romanian “lone hacker” had breached the DNC. The GRU was still sticking to this version of the story by mid-January 2017, when the CrowdStrike-is-Ukrainian narrative had already emerged organically and established itself in the United States. “Here I am again my friends,” Guccifer 2.0 wrote on January 12, 2017, posing as a Romanian hacker. “I have totally no relation to the Russian government.”

But here’s the essential point. Even if Kilimnik’s evidence-free statement that Ukraine hacked the DNC was a crucial seed of today’s toxic conspiracy theory (which seems unlikely), and even if some Russian handler instructed him to place that seed into Manafort’s mind (which is unproven), then alt-right amateur sleuths, American conspiracy theorists, Trump aides, and his unswerving congressional backers had to circumnavigate a large and growing mountain of hard evidence that implicated Russian intelligence in the 2016 active-measures campaign. They had to come up with ever more twisted ways to explain that evidence away. And they had to work tirelessly to spread their alternative theories.

American conservatives and elected officials are not passive, remote-controlled dummies that can be swayed with one distant statement or obscure social-media post—and thus absolved of responsibility for peddling and improving on outlandish conspiracy theories. Blaming domestic ills on foreign interference is a temptation that befits weakening democracies.

Again, perhaps American intelligence agencies have solid evidence that Russia had a pivotal role in developing the Ukraine conspiracy theories. If so, they need to deliver the goods, and show at least some of this evidence to Americans in an official public statement. Countering disinformation with, in effect, more disinformation is counterproductive, even dangerous; indeed, it is not too dramatic to say that this tendency plays right into the Kremlin’s hands.

Russian intelligence agencies have historically designed and modified ongoing operations so Russia’s adversaries would overestimate its strength, and come to believe that Moscow was more influential than it actually was. Russian active-measures operators know, and we should learn, that exaggerating the effects of disinformation means amplifying the effects of disinformation.