US pushes to assess damage from leak of Ukraine war files

Justice Department launches probe amid fears over classified documents’ impact on global security.

A Ukrainian serviceman fires a rocket-propelled grenade during training in the Donetsk on Friday. Picture: AFP

The US worked on Sunday to assess the damage of a widespread intelligence breach, as the Pentagon and the Justice Department seek answers to how dozens of images that purport to show highly classified documents on the war in Ukraine and other international matters surfaced online.

Determining the source of the leak and its implications has dominated the attention of leadership at the Pentagon, defence officials said, as a wide-ranging internal government probe gathered steam over the holiday weekend.

While some of the documents are roughly two months old, their disclosure could affect the conduct of the war in Ukraine because they purport to spell out potential battlefield vulnerabilities and the composition of parts of Ukraine’s forces, US officials said.

The documents also appear to include intelligence on internal matters in a variety of nations, including allies Israel, South Korea and Britain. The leak is likely to have an impact on US national security worldwide, officials said.

The Wall Street Journal wasn’t able to independently authenticate the documents, but they contain enough detail to give them credibility. Defence officials have said they believe some of the documents could be authentic, though some also appear to have been altered.

Taken together, the document dump, initially made in a small forum on the Discord messaging platform, is shaping up to be one of the most damaging intelligence breaches in decades. The unauthorised disclosure of highly sensitive information has alarmed not only top US security officials but also allies with whom the US shares secret intelligence.

Some US security partners are playing down the impact of the breach on operations covered in the documents.

Andriy Chernyak, a spokesman for Ukrainian military intelligence, described the leaked documents as an “operation by Russia’s special services”. “This will in no way affect our continued co-operation with allies,” he said. Asked about the Ukrainian counteroffensive against Russian forces expected in coming weeks, he said military operations will be carried out according to plans set out by the military command.

Still, Ukrainian President Volodymyr Zelensky said on Friday, after the first reports of the breach emerged, that Kyiv has decided to adopt new measures to prevent unauthorised disclosure of its military plans ahead of the counter-offensive.

Some experts who have studied the documents are doubtful the breach is part of a Russian disinformation campaign.

Aric Toler, head of research and training at the Bellingcat investigative consortium, which has done several high-profile probes of Russian intelligence operations, said that he had traced the original source of the posting to a small group of users called Thug Shaker Central on Discord. Hundreds of files were posted there in January, February and March. Later, some of these documents were reposted by users to a bigger group, uniting fans of the Minecraft game. The original group has since been wiped clean, as was the much bigger document trove.

“I really doubt this is some Russian op, so there’s a good chance only a few internet weirdos saw the hundreds of documents,” said Eliot Higgins, the founder of Bellingcat. “It’s really only something you’d find if you were terminally online.”

The FBI and the Justice Department launched a probe into the leak on Friday at the request of the Defence Department. Investigators are trying to quickly identify the source of the breach.

Justice Department officials said they had been in touch with officials at the Defence Department as their investigation got under way. Such probes usually begin by determining who had access to the documents, current and former officials said, which in this case could be difficult, as potentially hundreds of government employees have security clearances that would give them the ability to view the documents.

Justice Department spokespeople declined to comment on the investigation.

The US is considering a range of possibilities over how the breach occurred, including that someone with top-secret security clearance leaked the information or that US intelligence systems were hacked, US officials said.

US congressional leadership hasn’t been briefed about a leak but has requested one, a congressional aide said. “We don’t know the scope of this so it is hard to assess,” the aide said.

The White House was concerned about the damage caused by the leaks, US officials said. One official said some of the documents appeared to be manipulated but that the Biden administration was still gathering information about the matter.

The images were marked with “Top Secret” and other classifications indicating they represent highly sensitive US-produced intelligence.

The documents, which appear to originate from within the US military and intelligence agencies, include details about the disposition of Ukrainian forces, air defences and military equipment, classified information about arms and support the US has provided to Kyiv in its fight against Russia, and intelligence on internal matters in several nations.

In addition to documents pertaining to the war in Ukraine, the leaked files included purported copies of the daily intelligence report provided to Defence Secretary Lloyd Austin and Chairman of the Joint Chiefs of Staff Mark Milley, CIA reports on leaders of Israel’s Mossad spy service, and intelligence on discussions within the government of South Korea on sales of artillery ammunition to Kyiv.

Because the documents appear to be images of printed presentation slides, the investigation will likely focus on that possible method of transferring them from a classified system. Classified documents can only be printed on approved systems, which can be tracked.

In 2017, the government quickly identified Reality Winner, at the time a contractor for the National Security Agency, who printed out top-secret material and sent it to a news organisation. The government was able to track that only six people had printed the document since it was published to a classified computer network, and then quickly narrowed it down to Ms Winner, who later pleaded guilty to leaking the information.

In another leak to the media, Terry Albury, an FBI special agent, tried to avoid detection by cutting and pasting information from different classified documents into a new one, and then printing it, according to the government. He also, the government said, took pictures of classified documents from his computer screen, so as to avoid printing them. He was identified and pleaded guilty in 2018 to unauthorised retention and transmission of classified information.

Ms Winner and Mr Albury, both of whom served time in prison for their disclosures, said they leaked information to the media in the hopes of turning public attention to important issues. Ms Winner said the document she leaked was intended to prove Russian interference in the 2016 elections, while Mr Albury has described his disclosures as intending to cast light on what he alleged were FBI abuses.

Ms Winner declined to comment. Mr Albury deferred to his lawyer, who didn’t immediately respond to a request for comment.

The Wall Street Journal