The release Wednesday of the text of that call prompted an ecstatic response on right-wing corners of the Internet. “CROWDSTRIKE IS BACK ON THE MENU BOYS,” said one thread Wednesday on the Reddit message board “the_donald,” devoted to pro-Trump discussion. In another thread, a commenter wrote, “Trump just put ‘Ukrainian CrowdStrike’ into the consciousness and conversation of every normie that is following this story.”
But more broadly, the vilification of CrowdStrike, a firm that long has worked closely with U.S. officials, illustrates the shape-shifting nature of misinformation as it moves across media, mixing fact with innuendo before ultimately reaching the president — owner of the world’s loudest megaphone.
“This is insane,” said Robert Johnston, CEO of Adlumin and a former CrowdStrike investigator who worked on the probe into the hacking of Democratic National Committee computers. “This is absolute babbling to the president of Ukraine. It’s hard to finger exactly which conspiracy theory he’s subscribing to. But none of them have any grounding in reality.”
The month before the Ukraine call, Trump voiced dark suspicions about CrowdStrike in a call with Fox News commentator Sean Hannity. That same day, Breitbart News had published a story, based on documents that had emerged in Stone’s trial on charges of lying, obstruction and witness tampering, about how the FBI relied on information from CrowdStrike in its probe of the DNC hack.
“Take a look at Ukraine,” Trump said to Hannity in a conversation that was broadcast on his show. “How come the FBI didn’t take the server from the DNC? Just think about that one, Sean.”
People familiar with the president’s thinking said he has come to suspect the DNC server hacked by Russian intelligence agents in 2016 may have been hidden in Ukraine. The president has been known to embrace conspiracy theories, but it wasn’t immediately clear how he reached that belief about the DNC server or how that would even have been physically possible.
While it’s true that the FBI did not take custody of the affected servers, people familiar with FBI hack investigations say the agency often relies on forensic analysis by outside firms, including CrowdStrike, which is among the nation’s most prominent, having handled North Korea’s hack of Sony Pictures in 2014, among others. CrowdStrike said it “provided all forensic evidence and analysis to the FBI.”
The FBI felt it was not necessary to enter the DNC's premises and take custody of the affected servers, as agents were able to obtain complete copies of forensic images made by CrowdStrike, according to people familiar with the investigation.
The issue emerged again, on July 25, when Trump urged Ukrainian President Volodymyr Zelensky to investigate CrowdStrike during a call in which he also belittled special counsel Robert S. Mueller III and urged investigation of the son of former vice president Joseph Biden. Notes from the call were released Wednesday amid a scandal over whether Trump improperly pressured a foreign leader to investigate a political opponent, using nearly $400 million in expected foreign aid as leverage.
The nature of Trump’s reference to CrowdStrike is not obvious from the notes the White House released. At one point, he said, “I would like you to do us a favor though because our country has been through a lot and Ukraine knows a lot about it. I would like you to find out what happened with this whole situation with Ukraine, they say CrowdStrike … I guess you have one of your wealthy people … The server, they say, Ukraine has it.”
Trump added, “I would like to have the Attorney General call you or your people and I would like you to get to the bottom of it.” Zelensky appeared to agree to the request, saying his new prosecutor general “will look into the situation, specifically to the company that you mentioned.”
The Silicon Valley-based cybersecurity firm’s assertion in June 2016 that Russia had hacked the DNC has been repeatedly confirmed by the Justice Department, members of Congress and Mueller’s office, which indicted 12 Russian intelligence officers last year for their role in the breach.
Nevertheless, the company has become a boogeyman of right-wing conspiracy theorists, who have falsely claimed that the company helped Democratic leaders cover up what they insist was a breach by a secret party insider.
Trump's comments on Wednesday helped solidify the company as a punching bag for his allies in the right-wing media. Talk-show host Rush Limbaugh said the “reference to CrowdStrike, mark my words, is momentous,” and added, “The Democrats are bent out of shape that Trump even knows about CrowdStrike."
President Trump has long made CrowdStrike a target. He’s echoed conspiracy theorists in claiming that the company is owned by, as he said in 2017, “a very rich Ukrainian.” The company’s co-founder Dmitri Alperovitch is a Russia-born cyber and national security expert and a U.S. citizen. He is also a senior fellow at the Atlantic Council, a major Washington think tank whose donors include the foundation of Viktor Pinchuk, a Ukrainian billionaire.
The company has also been pulled into the QAnon conspiracy theory, after an anonymous author — purportedly, a top-secret intelligence officer slowly revealing Trump's plot to foil a global pedophile cabal — claimed last year that CrowdStrike had helped China access Hillary Clinton's emails. (No officials have alleged anything close to that.)
CrowdStrike said in a statement Wednesday that it stands by its “findings and conclusions that have been fully supported by the U.S. intelligence community.” The $14 billion company saw its stock fall roughly 1 percent Wednesday.
As CrowdStrike trended on Twitter Wednesday, driven by false claims about the company, Facebook also surfaced misinformation for queries of the firm's name. Among the top results was an article featuring a meme of DNC chairman Tom Perez in a wig along with erroneous claims about the “CrowdStrike ruse.” The site touts itself as “The First Stop on Your Daily Commute to the Truth."
Suspicion about CrowdStrike’s role appears to have first entered the conservative media ecosystem in early 2017, following a BuzzFeed report that the FBI had not requested access to the DNC servers before concluding that they were penetrated by Russian hackers. In January 2017, Breitbart ran an article conveying basic details about the firm’s leadership and raising questions about its ties to Google. (CrowdStrike has plainly advertised investments made by a private equity firm affiliated with Google.)
Two months later, Tony Shaffer, a member of Trump’s 2020 reelection advisory board, posted on Facebook, “When the FBI accepts info from DNC-Hired Cybersecurity Firm & adopts the report as their own we have a big problem."
In June 2017, the conservative news site Daily Caller said “a cloud of doubt (was) hanging over the DNC’s Russia narrative” in part due to the involvement by CrowdStrike, which it said was “Funded By Clinton-Loving Google $$." A month later, the conservative Washington Times wrote that “CrowdStrike’s evidence for blaming Russia for the hack is thin."
That theory has been boosted by Stone, Trump's longtime adviser, who has argued in legal filings this year that CrowdStrike's analysis was fatally compromised. Stone and others in Trump's orbit have alleged without evidence that Democratic insiders spearheaded the breach.
Trump’s mention of CrowdStrike suggests he still doubts the intelligence community’s findings of Russian involvement. DNC spokeswoman Xochitl Hinojosa tweeted that it was “complete nonsense” and “surreal” that “Trump used “a call with a foreign leader to push conspiracy theories.”
Devlin Barrett and Isaac Stanley-Becker contributed to this report.