Downtown Kyiv, Ukraine

Downtown Kyiv, Ukraine Sergey Slonitskyi / Shutterstock

Who’s Really to Blame for the ‘Ukraine Did It’ Conspiracy Theory?

Judging on the basis of public evidence, the narrative about Ukraine was propagated first and foremost by Americans, not Russian disinformation puppeteers.

In her eloquent impeachment testimony last month, Fiona Hill, a recently departed official at the National Security Council, criticized President Donald Trump and his supporters for parroting that Ukraine, not Russia, interfered in the 2016 elections. “This is a fictional narrative that has been perpetrated and propagated by the Russian security services themselves,” Hill said on November 21. The next day, The New York Times reported that senior intelligence officials had briefed senators that Russia, “starting at least in 2017,” had tried to frame Ukraine for interfering in the 2016 election.

Within days, the narrative that Russia framed Ukraine became conventional wisdom among leading journalists and commentators in Washington, D.C. “This ‘it was Ukraine narrative’ may go down in history as the most successful disinformation campaign by the Russian intelligence agencies,” wrote Alina Polyakova of the Brookings Institution, in response to Republican Senator John Kennedy calling into question that Russia hacked the DNC on Fox News. The Washington Post’s Shane Harris, one of the nation’s most respected national-security reporters, reminded Kennedy that the U.S. “has intelligence, which members of Congress have access to, that the Ukraine-did-it story was concocted and peddled by Russia.”

Perhaps the CIA or NSA has indeed assessed—informed by secret intelligence, with high confidence—that Russia planted the idea in Trump’s mind that Ukraine interfered in his election, and that the Kremlin thus triggered a history-making impeachment vote. It’s hard to know what we don’t know. But neither Fiona Hill nor the Times offered the concrete details, direct quotes, or names that would ordinarily back up such a grave claim.

Disinformation campaigns are almost always designed for publicity, and therefore leave public traces. Judging solely on the basis of publicly available evidence, the fictional narrative about Ukraine was concocted and propagated first and foremost by American conspiracy theorists, not Russian disinformation puppeteers.

Related: To Fight Disinformation, Rethink Counterintelligence

Related: Ukraine’s Election Is an All-Out Disinformation Battle

Related: The Magpies and the Cuckoos: A Disinformation Fable

The conspiracy theory that “Ukraine did it” comes in three progressively more extreme versions, and each time the “it” that Ukraine “did” is different. The first version is that Ukraine interfered in the 2016 election on behalf of Hillary Clinton; the second version is that somebody in Ukraine, not Russia, hacked Democratic computer networks in 2016; and the final version is that CrowdStrike, the security firm that helped the DNC, somehow is “Ukrainian-based” or “owned,” and that the DNC server is in Ukraine. (For the record: CrowdStrike was never based in Ukraine, or owned by anybody Ukrainian, and one physical DNC server never existed, because the infrastructure in question was cloud-based.) I’ll refer to those three theories as Ukraine-interfered, Ukraine-hacked, and Ukraine-owned.

Trump, since at least April 2017, subscribes to a mix of all these Ukraine conspiracy theories, as suggested by the summary of his July 25, 2019, call to Ukrainian President Volodymyr Zelensky, and by his 53-minute conversation with Fox & Friends on November 22.

So when and how did these three layers of conspiracy theories emerge?

The Ukraine-interfered narrative originated, legitimately, in Ukraine itself. By the end of May 2016, the paper Ukrayinska Pravda reported on the so-called black ledger, a 22-page document that revealed corruption under Viktor Yanukovych, a former pro-Russian president of Ukraine. On August 14, 2016, the Times broke the story that the handwritten ledger listed Paul Manafort, then Trump’s campaign manager, as the recipient of $12.7 million in undisclosed cash payments from Ukraine’s pro-Russian political party. Less than a week later, Manafort resigned. Another week later, on August 28, a Financial Times headline read: “Ukraine’s Leaders Campaign Against ‘Pro-Putin’ Trump”; the piece argued that Ukrainian politicians were “intervening” in a U.S. election. Trump’s confidant Roger Stone read the FT piece, republished it on his personal website, and shared it on September 6 with his then 79,000 followers on Twitter—an entire month before the John Podesta leaks even started. “The only interference in the US election is from Hillary’s friends in Ukraine,” Stone said. The Ukraine-interfered idea further gained steam in early 2017, thanks to a now-infamous Politico investigation, which was circulated, in turn, by the far right.

Russian disinformation actors active in the 2016 campaign, including both the Internet Research Agency (IRA) in St. Petersburg and Military Intelligence in Moscow (GRU), indeed boosted the Ukraine-interfered narrative. But they did so rather late in the game, about half a year after it had first appeared, IRA activity released by Twitter shows. “Where’s the outrage over Clinton and her campaign team’s collusion with Ukraine to interfere in the US election?” tweeted @USA_Gunslinger on July 13, 2017, one of the IRA’s main fake-conservative accounts. None of the IRA’s Facebook ads mention Ukraine. One known GRU front, CyberBerkut, attempted to promote the Ukraine-interfered narrative with a blog post in June 2017. It would appear that Russian actors did not “concoct” this version of the theory; they parroted the American far right.

The Ukraine-hacked narrative has a murkier origin story. In a document release last month, the FBI revealed one notable detail: During an interview with the FBI, Rick Gates, Manafort’s former deputy, recalled that Konstantin Kilimnik, one of Manafort’s business partners with alleged links to Russian intelligence, advanced the narrative that Ukraine had a role in the DNC hack. “Gates recalled Manafort saying the hack was likely carried out by the Ukrainians, not the Russians, which parroted a narrative Kilimnik often supported,” according to an FBI document, which then adds, confusingly, that “Kilimnik also opined the hack could have been perpetrated by Russian operatives in Ukraine.” It is unclear from Gates’s recollection when exactly this statement was made, and how persistently Manafort in turn repeated it.

The Ukraine-hacked conspiracy theory is usually combined with a version of the CrowdStrike conspiracy theory, in which the cybersecurity firm somehow engineered the DNC leak while framing Russian intelligence. Kilimnik, notably, does not appear to have advanced this far more common version of the theory.

Of all the Ukraine conspiracy theories, the Ukraine-owned narrative received the most attention early on. It appears to have originated in the first days of January 2017, both on the far right and the far left, almost at the same time—in response to a Ukraine-related Department of Homeland Security intelligence release and a Ukraine-related CrowdStrike report from late December.

In the wee hours of January 3, Washington’s Blog, a popular but now defunct alt-right site, ran a rambling, 5,600-word piece titled: “Why Crowdstrike’s Russian Hacking Story Fell Apart.” The piece quoted a litany of rumors, and then homed in on Dmitri Alperovitch, a founder of CrowdStrike: “He isn’t serving US interests. He’s definitely a Ukrainian patriot. Maybe he should move to Ukraine.”

That same day, The Nation published its own article focused on CrowdStrike. The magazine pointed out that Alperovitch is a senior fellow at the Atlantic Council, and that the D.C. think tank was funded in part by “the Ukrainian World Congress, and the Ukrainian oligarch Victor Pinchuk,” thus insinuating that CrowdStrike was somehow linked to Ukrainian money and secret influence. Washington’s Blog picked up the Pinchuk allegation two days later, and Breitbart News also started looking into CrowdStrike.

Known Russian disinformation outlets neither engineered the Ukrainian-owned theory, nor did they amplify it effectively. CyberBerkut never mentioned CrowdStrike, despite pushing the Ukraine-interfered narrative. I analyzed more than 10 million IRA tweets, and found that fewer than 100 mention CrowdStrike. Out of those, only one alludes to “ties” to a Ukrainian billionaire—and that post was late, from March 2017, and simply retweeted a U.S. account that was linking to U.S. content.

Context is crucial here. The GRU, the most important disinformation agent in 2016, came up with an early counterclaim to CrowdStrike’s correct revelation that Russian military intelligence had hacked the DNC: the Guccifer 2.0 persona claimed, in an expletive-laden post seemingly written in haste, that a Romanian “lone hacker” had breached the DNC. The GRU was still sticking to this version of the story by mid-January 2017, when the CrowdStrike-is-Ukrainian narrative had already emerged organically and established itself in the United States. “Here I am again my friends,” Guccifer 2.0 wrote on January 12, 2017, posing as a Romanian hacker. “I have totally no relation to the Russian government.”

But here’s the essential point. Even if Kilimnik’s evidence-free statement that Ukraine hacked the DNC was a crucial seed of today’s toxic conspiracy theory (which seems unlikely), and even if some Russian handler instructed him to place that seed into Manafort’s mind (which is unproven), then alt-right amateur sleuths, American conspiracy theorists, Trump aides, and his unswerving congressional backers had to circumnavigate a large and growing mountain of hard evidence that implicated Russian intelligence in the 2016 active-measures campaign. They had to come up with ever more twisted ways to explain that evidence away. And they had to work tirelessly to spread their alternative theories.

American conservatives and elected officials are not passive, remote-controlled dummies that can be swayed with one distant statement or obscure social-media post—and thus absolved of responsibility for peddling and improving on outlandish conspiracy theories. Blaming domestic ills on foreign interference is a temptation that befits weakening democracies.

Again, perhaps American intelligence agencies have solid evidence that Russia had a pivotal role in developing the Ukraine conspiracy theories. If so, they need to deliver the goods, and show at least some of this evidence to Americans in an official public statement. Countering disinformation with, in effect, more disinformation is counterproductive, even dangerous; indeed, it is not too dramatic to say that this tendency plays right into the Kremlin’s hands.

Russian intelligence agencies have historically designed and modified ongoing operations so Russia’s adversaries would overestimate its strength, and come to believe that Moscow was more influential than it actually was. Russian active-measures operators know, and we should learn, that exaggerating the effects of disinformation means amplifying the effects of disinformation.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.