How U.S. Law Enforcement Caught the NSA Contractor Charged with Leaking Top-Secret Materials
The scanned copy of the document "appeared to be folded and/or creased," the FBI agent wrote, "suggesting they had been printed and hand-carried out of a secured space."
About an hour after the Intercept published a top-secret document stolen from the U.S. National Security Agency June 5, the Department of Justice (DOJ) announced that the Federal Bureau of Investigation (FBI) had arrested a suspected leaker. The 25-year-old contractor who worked for the Pluribus International Corporation in Georgia, Reality Leigh Winner, was charged “with removing classified material from a government facility and mailing it to a news outlet.”
The document published by the Intercept details a cyber espionage campaign that Russia’s military intelligence agency carried out against US government organizations and an unnamed US company that develops voter-registration software. The attacks occurred between August and October of 2016, just before the US presidential election on Nov. 8.
The operation that zeroed in on Winner as the suspect who leaked the classified materials was described by a FBI agent in an affidavit released by the DOJ. On June 1, the agent wrote, the FBI was given a copy of the leaked document, which the news outlet had given to another agency, presumably the National Security Agency (NSA). That agency had verified that the document was authentic, and inspected it closely.
The scanned copy of the document “appeared to be folded and/or creased,” the agent wrote, “suggesting they had been printed and hand-carried out of a secured space.” The unnamed agency then conducted an internal audit to determine who had recently printed the materials in question, and found six people who had.
“A further audit of the six individuals’ desk computers revealed that WINNER had e-mail contact with the News Outlet,” the agent wrote. “The audit did not reveal that any of the other individuals had e-mail contact with the News Outlet.”
The FBI agent spoke with Winner at her home in August, Georgia on June 3, according to the affidavit:
During that conversation, WINNER admitted intentionally identifying and printing the classified intelligence reporting at issue despite not having a ‘need to know,’ and with knowledge that the intelligence reporting was classified. WINNER further admitted removing the classified intelligence reporting from her office space, retaining it, and mailing it from Augusta, Georgia, to the News Outlet, which she knew was not authorized to receive or possess the documents. WINNER further acknowledged that she was aware of the contents of the intelligence reporting and that she knew the contents of the reporting could be used to the injury of the United States and to the advantage of a foreign nation.
Although several news organizations have cited anonymous government sources who say the document published by the Intercept is the one Winner allegedly stole and leaked, officials have not publicly confirmed that it is. Several key details between the Intercept’s article and information released by the DOJ, such as the date of the document in question, match up. Given the timing of the announcement, the link seems apparent.