In her eloquent impeachment testimony last month, Fiona Hill, a recently departed official at the National Security Council, criticized President Donald Trump and his supporters for parroting that Ukraine, not Russia, interfered in the 2016 elections.
"This is a fictional narrative that has been perpetrated and propagated by the Russian security services themselves," Hill said on November 21. The next day, The New York Times reported that senior intelligence officials had briefed senators that Russia, "starting at least in 2017," had tried to frame Ukraine for interfering in the 2016 election, The Atlantic reports.
Within days, the narrative that Russia framed Ukraine became conventional wisdom among leading journalists and commentators in Washington, D.C.
"This 'it was Ukraine narrative' may go down in history as the most successful disinformation campaign by the Russian intelligence agencies," wrote Alina Polyakova of the Brookings Institution, in response to Republican Senator John Kennedy calling into question that Russia hacked the DNC on Fox News.
The Washington Post’s Shane Harris, one of the nation’s most respected national-security reporters, reminded Kennedy that the U.S. "has intelligence, which members of Congress have access to, that the Ukraine-did-it story was concocted and peddled by Russia."
Perhaps the CIA or NSA has indeed assessed—informed by secret intelligence, with high confidence—that Russia planted the idea in Trump’s mind that Ukraine interfered in his election, and that the Kremlin thus triggered a history-making impeachment vote. It's hard to know what we don't know. But neither Fiona Hill nor the Times offered the concrete details, direct quotes, or names that would ordinarily back up such a grave claim.
Disinformation campaigns are almost always designed for publicity, and therefore leave public traces. Judging solely on the basis of publicly available evidence, the fictional narrative about Ukraine was concocted and propagated first and foremost by American conspiracy theorists, not Russian disinformation puppeteers.
The conspiracy theory that “Ukraine did it” comes in three progressively more extreme versions, and each time the “it” that Ukraine “did” is different. The first version is that Ukraine interfered in the 2016 election on behalf of Hillary Clinton; the second version is that somebody in Ukraine, not Russia, hacked Democratic computer networks in 2016; and the final version is that CrowdStrike, the security firm that helped the DNC, somehow is “Ukrainian-based” or “owned,” and that the DNC server is in Ukraine. (For the record: CrowdStrike was never based in Ukraine, or owned by anybody Ukrainian, and one physical DNC server never existed, because the infrastructure in question was cloud-based.)
Those three theories can be referred to as Ukraine-interfered, Ukraine-hacked, and Ukraine-owned.
Trump, since at least April 2017, subscribes to a mix of all these Ukraine conspiracy theories, as suggested by the summary of his July 25, 2019, call to Ukrainian President Volodymyr Zelensky, and by his 53-minute conversation with Fox & Friends on November 22. So when and how did these three layers of conspiracy theories emerge?
The Ukraine-interfered narrative originated, legitimately, in Ukraine itself. By the end of May 2016, the paper Ukrayinska Pravda reported on the so-called black ledger, a 22-page document that revealed corruption under Viktor Yanukovych, a former pro-Russian president of Ukraine. On August 14, 2016, the Times broke the story that the handwritten ledger listed Paul Manafort, then Trump's campaign manager, as the recipient of $12.7 million in undisclosed cash payments from Ukraine's pro-Russian political party.
Less than a week later, Manafort resigned. Another week later, on August 28, a Financial Times headline read: "Ukraine's Leaders Campaign Against 'Pro-Putin' Trump"; the piece argued that Ukrainian politicians were "intervening" in a U.S. election.
Trump's confidant Roger Stone read the FT piece, republished it on his personal website, and shared it on September 6 with his then 79,000 followers on Twitter – an entire month before the John Podesta leaks even started.
"The only interference in the US election is from Hillary's friends in Ukraine," Stone said.
The Ukraine-interfered idea further gained steam in early 2017, thanks to a now-infamous Politico investigation, which was circulated, in turn, by the far right. Russian disinformation actors active in the 2016 campaign, including both the Internet Research Agency (IRA) in St. Petersburg and Military Intelligence in Moscow (GRU), indeed boosted the Ukraine-interfered narrative. But they did so rather late in the game, about half a year after it had first appeared, IRA activity released by Twitter shows.
"Where's the outrage over Clinton and her campaign team's collusion with Ukraine to interfere in the US election?" tweeted @USA_Gunslinger on July 13, 2017, one of the IRA's main fake-conservative accounts.
One known GRU front, CyberBerkut, attempted to promote the Ukraine-interfered narrative with a blog post in June 2017. It would appear that Russian actors did not “concoct” this version of the theory; they parroted the American far right.
The Ukraine-hacked narrative has a murkier origin story. In a document release last month, the FBI revealed one notable detail: During an interview with the FBI, Rick Gates, Manafort's former deputy, recalled that Konstantin Kilimnik, one of Manafort’s business partners with alleged links to Russian intelligence, advanced the narrative that Ukraine had a role in the DNC hack.
"Gates recalled Manafort saying the hack was likely carried out by the Ukrainians, not the Russians, which parroted a narrative Kilimnik often supported," according to an FBI document, which then adds, confusingly, that "Kilimnik also opined the hack could have been perpetrated by Russian operatives in Ukraine."
It is unclear from Gates's recollection when exactly this statement was made, and how persistently Manafort in turn repeated it.
The Ukraine-hacked conspiracy theory is usually combined with a version of the CrowdStrike conspiracy theory, in which the cybersecurity firm somehow engineered the DNC leak while framing Russian intelligence. Kilimnik, notably, does not appear to have advanced this far more common version of the theory.
Of all the Ukraine conspiracy theories, the Ukraine-owned narrative received the most attention early on. It appears to have originated in the first days of January 2017, both on the far right and the far left, almost at the same time—in response to a Ukraine-related Department of Homeland Security intelligence release and a Ukraine-related CrowdStrike report from late December.
In the wee hours of January 3, Washington's Blog, a popular, now defunct alt-right site, ran a rambling, 5,600-word piece titled: "Why Crowdstrike's Russian Hacking Story Fell Apart." The piece quoted a litany of rumors, and then homed in on Dmitri Alperovitch, a founder of CrowdStrike.
"He isn't serving US interests. He's definitely a Ukrainian patriot. Maybe he should move to Ukraine," the piece read.
That same day, The Nation published its own article focused on CrowdStrike. The magazine pointed out that Alperovitch is a senior fellow at the Atlantic Council, and that the D.C. think tank was funded in part by "the Ukrainian World Congress, and the Ukrainian oligarch Victor Pinchuk," thus insinuating that CrowdStrike was somehow linked to Ukrainian money and secret influence. Washington's Blog picked up the Pinchuk allegation two days later, and Breitbart News also started looking into CrowdStrike.
Russian intelligence agencies have historically designed and modified ongoing operations so Russia's adversaries would overestimate its strength, and come to believe that Moscow was more influential than it actually was. Russian active-measures operators know, and we should learn, that exaggerating the effects of disinformation means amplifying the effects of disinformation.