Here's How Donald Trump Ended Up Referencing A Russian-Promoted 4chan Conspiracy Theory In His Call To The Ukrainian President

From the depths of 4chan, to the president’s mouth, and then back to the depths of 4chan.

The White House released the record of a call between President Donald Trump and Ukraine’s President Volodymyr Zelensky on Wednesday. According to the document, Trump asked Zelensky to do him a “favor” and investigate the origins of the Russia probe as well as former vice president Joe Biden.

As the country’s mainstream media swarmed over the staff-written memorandum of the conversation, anonymous radicalized communities like 4chan and far-right pockets of Facebook, Reddit, and Telegram focused on something else. It wasn’t the possible abuse of power that sent them into a fervor, but instead the American president’s mention of CrowdStrike, a company that provides security, threat intelligence, and cyberattack response services, and which the Democratic National Committee hired to investigate the hack of its servers during the 2016 election campaign.

In the memorandum, Trump says to Zelensky, “I would like you to find out what happened with this whole situation with Ukraine, they say CrowdStrike… I guess you have one of your wealthy people… The server, they say Ukraine has it.”

One large 4chan thread was titled “HAPPENING: CROWDSTRIKE SERVER RELEASE IMMINENT,” another, “What is CrowdStrike, and why does their server seem to be important?” and another, “ULTIMATE HAPPENING: Trump mentions CROWDSTRIKE in Transcript release, Tied to DNC server & Seth Rich.”

CrowdStrike's role in a sprawling conspiracy carried out by the DNC started as wild conjecture on anonymous message boards in the lead up to the 2016 election. The flames were fanned by Russian news outlets like Russia Today and Sputnik News, who both published multiple pieces about it. It was then laundered into mainstream Republican discourse by figures like Roger Stone, Trump's former campaign adviser.

In a statement provided to BuzzFeed News, a CrowdStrike spokesperson pushed back at conspiracy theories about CrowdStrike’s work with the DNC in 2016.“We provided all forensic evidence and analysis to the FBI,” the CrowdStrike spokesperson said. “As we’ve stated before, we stand by our findings and conclusions that have been fully supported by the US Intelligence community.”

For Trump’s online fanbase, for CrowdStrike to make its way into the president’s conversation with a foreign leader — and to be subject of mainstream news articles (like the one you’re reading right now) — is vindication of a yearslong conspiracy theory. Here’s how CrowdStrike bubbled up from the online sludge and into the mouth of the American president — and may become part of the impeachment investigations.

In 2016, the Democratic National Committee hired CrowdStrike, which is based in Sunnyvale, California, to investigate a breach into their servers. The cybersecurity firm concluded that Russian government–backed hackers compromised the network, rejecting the idea that the hack was instead carried out by a lone wolf hacker named “Guccifer 2.0.”

CrowdStrike outlined their initial findings in a June 2016 blog post: “We observed the two Russian espionage groups compromise the same systems and engage separately in the theft of identical credentials.”

But the minute CrowdStrike released that conclusion — a full report came in December 2016 — they became a character in a sprawling online conspiracy, which sought to debunk the Russians' involvement. After BuzzFeed News reported on the findings, hyperpartisan website Breitbart raised concerns, based on CrowdStrike’s financial ties with Google.

That planted the seeds of doubt.

The most commonly used 4chan archive, 4plebs, which doesn’t include everything due to threads 404ing and disappearing, lists March 2017 as the earliest mention of CrowdStrike on the site.

“How did /pol/ spin the whole Trump under FBI investigation and the FBI and DoJ saying that Obama didn't wiretap Trump,” one user asks.

Another user responds with a timeline titled “Russia could not have been the source of leaked Democrat emails released by Wikileaks. Please read.” The user writes, “[The DNC’s] entire narrative around Russia has been fictionalized with the help of the CrowdStrike private cybersecurity company.”

Most likely this reference is to two more Breitbart articles that came out that same week painting CrowdStrike as a part of a DNC conspiracy to spread their own conspiracy about the Trump campaign colluding with the Russian government.

Less than a week later, according to a Google search, people on the pro-Trump subreddit The_Donald mention CrowdStrike for the first time. A user writes, “CrowdStrike did the DNC hacking report that's starting to unravel…," and links to a blog post on a financial site called iBankCoin. iBankCoin mentions the Breitbart reporting on CrowdStrike and then goes a step further to pull in false rumors that the firm had ties to the think tank the Atlantic Council, a common boogeyman for the far right.

This is also why so many in the far right believe CrowdStrike is Ukrainian-owned. The firm’s cofounder and CTO Dmitri Alperovitch has worked with the Atlantic Council. Victor Pinchuk, a Ukrainian oligarch and another long-standing 4chan boogeyman, is on the Atlantic Council’s International Advisory Board. Like a game of telephone, it seems like the fact that Alperovitch is a Russian American and Pinchuk is Ukrainian mutated together into one false theory that CrowdStrike is an anti-Russian operation run out of Ukraine.

It wasn’t until May 2017 that the threads of this online conspiracy connected around the death of DNC staffer Seth Rich. The Russian Embassy in the UK tweeted about it. Fox News reported that Rich "had leaked thousands of internal emails to WikiLeaks," citing a "federal investigator."

Bringing the whole thing together was a Reddit thread on The_Donald about Rich’s death that same month titled “BREAKING: I've found evidence that the DNC fabricated the Russian conspiracy all the way in June 2016, and that Seth Rich may have died to cover it up. Long but worth it!” It includes CrowdStrike as a major player in the DNC’s supposed inside job conspiracy.

According to 4plebs, the 4chan community excitedly talked about the conspiracy theory all summer. CrowdStrike and their supposed ties to the Atlantic Council appear in an April thread about conspiracy theories of child trafficking by Democratic leaders, in a September thread about former Hillary Clinton campaign chair John Podesta’s emails, and in a November thread about a Daily Caller story about Rep. Debbie Wasserman Schultz, the former head of the DNC, not telling employees about the server breach.

Even Trump seemed to have picked up on some of the chatter around CrowdStrike by then. In April 2017, Trump, in an interview with the AP, says, “Why wouldn’t Podesta and Hillary Clinton allow the FBI to see the server? They brought in another company that I hear is Ukrainian-based.”

“CrowdStrike,” the AP reporter asks.

“That’s what I heard. I heard it’s owned by a very rich Ukrainian, that’s what I heard. But they brought in another company to investigate the server,” Trump replies. “Why didn’t they allow the FBI in to investigate the server?”

In his answer, Trump swirls together a bunch of rumors about CrowdStrike into one mass. He also seems to think that it’s just one physical server that actually went missing and not 140 cloud-based servers that were decommissioned in 2016.

All of these disparate elements did finally came together on Oct. 28, 2017, with the first QAnon post. QAnon is like the final evolution of all the far-right pro-Trump online conspiracy movements. The nonsensical evidence-free mega-conspiracy theory was finally something vague enough to incorporate every bit of violent and paranoid fan fiction communities like 4chan and Reddit had been crowdsourcing since 2014. It pulled in Seth Rich’s death, the Democrat-led global pedophile ring from Pizzagate, the DNC inside job conspiracy, and, in December 2017, it pulled in CrowdStrike, as well.

According to the Q-tracking website QAlerts, CrowdStrike appeared in an update in December 2017. QAnon posts are written in borderline nonsense jargon, closer to reading tea leaves than coherent posts, but according to QAlerts, the cybersecurity firm appeared in 10 updates, one as recent as October 2018.

Imagining President Trump on 4chan or Reddit is ridiculous, but he has frequently interacted with QAnon supporters both on Twitter and in real life. He has tweeted about the Deep State. There have also been several instances of ideas crawling out of the far-right internet swamps onto Trump’s phone.

All of that leads to Trump’s conversation with the Ukrainian president this week, in which Trump asks him for a favor. That favor, as Trump puts it, is to find out what happened with “this whole situation with Ukraine.” Trump mentions a server and claims someone very wealthy in Ukraine has it, potentially a garbled reference to Alperovitch or Pinchuk.

CrowdStrike, once seeded into the online discourse by hyperpartisan news outlets, never left. The firm continually appears as a bit player in a massive conspiracy to discredit the conventional narrative of the DNC hack, or delegitimize the Trump presidential victory, or cover up the murder of Seth Rich, or hide the existence of a global pedophile ring. It depends on the message board and the day.

Yet again, conspiracy theorists have proof that the president is tapped into their reality, and the message board trolls following the president’s every move aren’t likely to let this go.

“Twitter is exploding over Crowdstrike and Seth Rich,” one 4chan user wrote Thursday. “Trump Knows about Crowdstrike...It's fucking happening!”


The White House released the record of the call between Trump and Zelensky on Wednesday. The day was misstated in a previous version of this post.

Topics in this article

Skip to footer