An anonymous post from March 2017 on the far-right 4chan message board teased a conspiracy theory that would eventually make its way to the White House.
“Russia could not have been the source of leaked Democrat emails released by Wikileaks,” the post teased, not citing any evidence for the assertion.
The post baselessly insinuated that CrowdStrike, a cybersecurity firm that worked with the Democratic National Committee and had been contracted to investigate a hack of its servers, fabricated a forensics report to frame Russia for election interference. The 4chan post was published three days before then-FBI Director James Comey testified before Congress about Russian interference in the 2016 election.
And that was how it started. That post is the first known written evidence of this unfounded conspiracy theory to exonerate Russia from meddling in the 2016 election, which more than two years later would make its way into the telephone call that may get President Donald Trump impeached. (Federal law enforcement officials have repeatedly made it clear that Russia unquestionably did meddle in the election.)
In the years that followed the original 4chan post, at least three different but related conspiracy theories would warp and combine on the fringes of the internet, eventually coalescing around Ukraine’s supposed role in helping Trump’s 2016 opponent, Hillary Clinton.
Ukraine wasn’t originally part of the theory, but in July, Trump floated CrowdStrike’s name during a call with the president of Ukraine as just one piece of a convoluted conspiracy accusation. That phone call is now at the center of a congressional investigation and impeachment inquiry into whether the president abused his power for political gain.
“I would like to find out what happened with this whole situation with Ukraine, they say CrowdStrike … ” Trump said on the call, according to a White House summary. “I guess you have one of your wealthy people. ... The server, they say Ukraine has it.”
To even people who have followed these theories closely, Trump’s call felt detached from any sense of logic.
“It’s a whole new mountain of nonsense,” said Duncan Campbell, a British digital forensics expert who investigated the original claim about CrowdStrike.
This omnibus conspiracy theory has been frequently referred to on far-right blogs, Fox News and recently by the president as the Democrats’ “insurance policy,” a reference to the supposed setup as a way to impeach the president if Trump were to win the election.
Though all the individual theories have been debunked, each has contributed elements that have been cited by the president, as well as his personal lawyer, Rudy Giuliani.
Beginning months after Trump’s inauguration, conspiracy theorists have pushed this fanciful and unsubstantiated narrative in which the Democratic National Committee framed Russia for its election interference in 2016 and later covered up its false accusation with help from then-Vice President Joe Biden and officials in Ukraine.
In the conspiracy theory, impeachment proceedings recently pursued by House Democrats were always the DNC’s endgame, effectively a cash-out on the “insurance policy.”
Trump has repeatedly referred to the “insurance policy” by name in tweets and in remarks on the White House’s South Lawn.
“This is a study of Russia. Why didn’t they invest in the insurance policy? In other words, should Hillary Clinton lose, we’ve got an insurance policy,” Trump said in front of the White House on May 30. “Guess what? What we’re in right now is the insurance policy.”
Although Trump has often brought up various conspiracy theories, there had been little indication that the president had taken aggressive action on them. That changed last month, when the White House released the summary of a call with Ukraine. The subsequent release of a whistleblower complaint further confirmed that the ardently pro-Trump conspiracy theories that have percolated on the far right for years had reached the highest echelons of power — and influenced the decision-making of the president.
NBC News tracked these various threads in an attempt to understand how they evolved and how they eventually reached the president.
Campbell, the digital forensics expert, helped debunk the theory that CrowdStrike framed Russia for the DNC in 2018. He analyzed the data and the origin of documents that had been published on a blog two months after the 4chan post, which purported to contain proof that Russia couldn’t have hacked the DNC.
Campbell investigated the claims and found that the documents were fake, with metadata on the files offering proof that they were illegitimate. Campbell also tracked the source of the documents to a 39-year-old British internet troll working under a fake name who had frequently pushed pro-Russian conspiracy theories under various aliases.
But the fake documents proved effective in perpetuating the CrowdStrike theory. The fake documents found their way to a group of former intelligence officials called Veteran Intelligence Professionals for Sanity led by William Binney, a whistleblower who used to work at the National Security Agency. Binney pushed the conspiracy theory several times on Fox News and, at the request of Trump, met with then-CIA Director and current Secretary of State Mike Pompeo to discuss the theory. Binney has since disavowed the veracity of the documents after viewing the files’ metadata.
Two years later, in June, former Trump adviser Roger Stone revived the debunked CrowdStrike conspiracy theory as part of his defense. Stone has been charged with witness tampering and five counts of making false statements to the special counsel.
One month and 11 days after that, Trump brought up CrowdStrike in a call with Ukraine’s president.
Even after months of investigating the origins of the CrowdStrike conspiracy theory, Campbell said he doesn’t believe even the president has a full grasp of what the theory is meant to insinuate.
Campbell also said that CrowdStrike examined many servers as part of its investigation into how the DNC was hacked, whereas the president wondered on the phone with Ukraine’s president if a single server might be in Ukraine. The company also recently clarified that it had taken no servers into its possession as part of its DNC investigation.
Campbell said Trump may have mixed up even another conspiracy theory in a news conference last week, conflating Hillary Clinton’s email server with the DNC servers examined by CrowdStrike.
At Trump’s direction, the State Department has recently reignited a probe to find the contents of a private email server Clinton held when she was secretary of state. When asked by a reporter if he believes some of Clinton’s deleted emails could be in Ukraine, Trump replied, “I think they could be.”
“Trump’s comments seem to me to be incoherent, even in the context of this conspiracy theory,” Campbell said.
Nina Jankowicz, a former advisor to Ukraine’s foreign ministry, also said she was surprised when Trump mentioned CrowdStrike in conjunction with Ukraine.
“I was in Ukraine when the first conspiracies about ‘Ukrainian collusion’ was coming about,” Jankowicz said. “It was all this murky narrative about how maybe the Ukrainians wanted Hillary.”
Jankowicz said that while various conspiracy theories had swirled around Ukraine, none to her knowledge had touched on CrowdStrike. That company was part of a separate conspiracy theory that posited that the location of Clinton emails were hidden as part of a cover-up.
“Never was there any mention in 2016 of the DNC servers being in Ukraine,” said Jankowicz, who is now a fellow at the Wilson Center studying disinformation. “The whole CrowdStrike thing blows my mind.”
Conspiracy theorists were eager to tie CrowdStrike to yet another theory focused on one of the president’s political rivals: Joe Biden.
In March, John Solomon, a conservative opinion contributor to the politics-focused news website The Hill, began to gain traction with conservative media publications for a series of articles insinuating that the Biden family had been involved with a cover-up that included the vice president pressuring Ukraine’s president to fire a prosecutor who wanted to investigate the Biden family’s business connections in the country.
The theory has been widely debunked. While Hunter Biden, Joe Biden’s son, did work with a Ukrainian energy company, an investigation into his business relationships was later closed, and the investigator who was fired was the focus of international pressure due to a lack of corruption enforcement.
But the notion of a Biden-led cover-up dovetailed nicely with what Trump and many conspiracy theorists were working to prove — that Russia hadn’t hacked the election.
While it’s not clear how the CrowdStrike portion of the conspiracy theory reached Trump, outside of Binney’s meeting years before, Giuliani seized on the Ukraine thread publicly, while privately beginning to pursue an investigation.
In April, Masha Yovanovitch, then U.S. ambassador to Ukraine, was recalled to Washington. Yovanovitch had been mentioned by Solomon in his articles as denigrating Trump to Ukrainian officials, a claim that was echoed on Fox News.
“The idea was to make it look like Ambassador Yovanovitch was doing Clinton and Obama’s bidding,” Jankowicz said.
Looking to combine the two theories, online conspiracy theorists began pushing baseless rumors that CrowdStrike’s chief technology officer and co-founder, Dmitri Alperovitch, who is Russian-American, was simultaneously working for Ukraine. There is no evidence to support that claim.
The conspiracy theory about Biden wound up being repeated three times in Trump’s phone call with Ukraine’s president. The Hill’s columns were later explicitly mentioned in the whistleblower complaint about Trump’s interactions with Ukraine’s president that was released to Congress last week.
The Ukraine element fit particularly well with the “insurance policy” narrative that suggested any attempt to investigate the president was actually part of a Democratic conspiracy.
The phrase refers to a text sent from then-FBI agent Peter Strzok to FBI attorney Lisa Page, with whom he was having an affair. Strzok, who was investigating Russia’s interference into the 2016 election for the FBI, was texting with Page about internal debates about how publicized and prioritized the probe, which had not yet been made public, should be.
“It’s like an insurance policy in the unlikely event you die before 40,” Strzok wrote in a text, referring to the investigation. Transcripts of 16 months of texts between Strzok and Page were released by the Justice Department in December 2017.
Trump and conservative media have since taken the text to mean Strzok and members of what the president termed the “deep state” at the FBI were part of what he called a “coup” to remove him from office, even before he was elected.
For this conspiracy theory, Jankowicz said, the more anecdotes, the better — even if they don’t make sense when they’re all put together.
“That’s all the proof that any conspiracy theorist needs. Don’t look at the timeline at all. You just need a simple narrative to stick to,” Jankowicz said. “The more complicated you make it, the harder it is to figure out. And sometimes that’s the point.”
The Hill and Fox News
On March 23, Giuliani’s Twitter account hit “like” on a tweet featuring a video clip from Sean Hannity’s Fox News primetime show. In it, frequent guest commentator Joe DiGenova alleged that Ukrainian officials tried to help Hillary Clinton during the 2016 U.S. elections, referring to one of Solomon’s articles in The Hill.
That “like” by Giuliani is the earliest known public evidence of how this conspiracy theory reached the president’s personal lawyer, according to records of Giuliani’s social media activity preserved by NBC News.
In the six months since the Twitter interaction, Giuliani has tweeted numerous times in reference to the Ukraine theory, including falsely stating in April that “now Ukraine is investigating Hillary campaign and DNC conspiracy with foreign operatives including Ukrainian and others to affect 2016 election.” Ukraine is not investigating the Clinton campaign.
Other members of Trump’s inner circle have also promoted various accusations leveled against Biden that coincided with Giuliani’s efforts to dig up dirt on him. Legitimate concerns about Biden’s son and his business deal with the Ukrainian energy company Burisma have been folded into the conspiracy theory, conflating real-life conflict of interest questions with allegations of a fantastical conspiracy by a global cabal.
On Monday, Giuliani was subpoenaed for his involvement in the White House effort to dig up incriminating evidence on Biden; the article that was mentioned in the Fox News segment ended up as a part of a whistleblower complaint filed against the president; and Solomon’s main source has walked back some of the claims that helped fuel the article that reached Fox News.
The president now faces an impeachment inquiry into whether his attempts to pressure the president of Ukraine to investigate the conspiracy theory constitutes an abuse of power and if the president’s staff then tried to cover up the president’s actions.