Government looking for leaker in Ukraine documents probe

Investigators focusing on those with access to most-restricted documents.

Investigators are using clues in images that have circulated online to aid in its criminal investigation into the leak, officials say. Picture: The Wall Street Journal

The US government is treating the disclosure of classified material surrounding the war in Ukraine as an insider’s leak, people familiar with the matter say, but hasn’t yet homed in on key suspects for a massive intelligence breach that has exposed the challenges of safeguarding sensitive information and tested ties with some of America’s closest allies.

The bulk of the more than 60 documents, if genuine, appear to originate from the CIA’s operations centre and the Pentagon’s Joint Chiefs of Staff. Such documents are typically briefed to senior-level decision-makers at the Pentagon in an environment protected from electronic surveillance and secured against leaks.

The FBI is using clues in the images that have circulated online in recent weeks to aid its criminal investigation, law enforcement officials said. Some of the documents would be accessible to several hundred people, while others would be restricted to a much smaller group, US officials said. Focusing on access to the more restricted documents gives investigators a way to narrow the field of potential leakers, they said.

The Defence Department has extensive procedures around the handling of classified documents in both digital form and on paper, according to interviews with former intelligence community and Pentagon officials. Printing classified documents nearly always generates a digital trail of some kind, one that investigators have been able to follow in other cases of leaked documents.

Government printers connected to classified networks keep detailed logs of all classified documents printed on them. In addition, some contain invisible markings that can help trace the origin of the document. Many classified workspaces also have internal cameras to prevent the theft of paper documents.

Glenn Gerstell, a former general counsel with the National Security Agency, said a significant number of people might have access to these types of documents, which are widely used to brief senior-level policymakers around the government.

“The CIA briefing goes to a lot of people, including people on Capitol Hill. The Joint Chiefs book goes to a significant number of senior military leaders,” Mr Gerstell said. The documents are available in both digital and print form, he said, with significant security measures taken to protect the documents in either form.

“If you’re printing any of these reports out, they’re printed on secure printers. There isn’t stuff lying around on desks. It’s not a normal office,” Mr Gerstell said.

Even a photograph of a printed classified document can give investigators important clues about the material’s origins that can help propel their probe forward, said Joshua Skule, a former senior FBI executive and president of government contracting firm Bow Wave.

“The FBI will be conducting lab analysis from the evidence they collected, which could lead investigators to other clues like type of paper, ink and other items for follow-up,” Mr Skule said. “This is traditional investigative work in addition to technical forensics.”

The Wall Street Journal wasn’t able to independently authenticate the documents, but they contain enough detail to give them credibility. Defense officials have said they believe some of the documents could be authentic.

The leaked documents appear to have been printed and folded twice. In some images there are items clearly visible in the background, including a hunting magazine, a knife and a tube of Gorilla-brand glue. All could be clues as to how and by whom the documents came to be initially posted within a small group of individuals on Discord, a social media outlet popularised by video game enthusiastswhere users chat about games, investing and other topics in mostly private, invitation-only groups called servers.

That presentation, however, could have been contrived by a sophisticated adversary to throw off investigators, say former defence officials. Investigators haven’t yet definitively ruled out the possibility that the publication of the documents was a foreign-sponsored intelligence operation designed to look like a leak, or that classified information was somehow lost through mishandling and later posted by people not authorised to access it.

On Wednesday, Microsoft president Brad Smith said his company’s “digital-threat analysis team” has been spotting efforts by Russians in recent months to infiltrate online communities around video gaming in-game chats built into popular videogames have been used as a channel for covert communication by spies and terrorists in the past, according to people familiar with intelligence operations.

“It is the Wagner Group, it is Russian intelligence, and they’re just in part using this as a place to get information into circulation,” Mr Smith said at a summit convened by the news platform Semafor. “That’s what happened here. It included the Discord channel around Minecraft.” “It just happens to be a good place for them to get the information into circulation and then ultimately journalists find it,” he added.

Security controls around classified documents have proven vital to finding past leakers. In 2017, the government quickly identified Reality Winner, at the time a contractor for the NSA, who printed out top-secret material and sent it to the Intercept, an online news organisation. The government determined that only six people had printed the document during the time it was to a classified computer network, and then quickly narrowed the field of possible culprits down to Ms Winner, who later pleaded guilty to leaking the information.

In another leak to the media, Terry Albury, an FBI special agent, tried to avoid detection by cutting and pasting information from different classified documents into a new one and then printing it, according to the government. He also, the government said, took pictures of classified documents from his computer screen to avoid printing them. He was identified and pleaded guilty in 2018 to unauthorised retention and transmission of classified information.

Ms Winner and Mr Albury, both of whom served time in prison for their disclosures, said they leaked information to the media in hopes of turning public attention to what they saw as important issues.

The Wall Street Journal