How U.S. Law Enforcement Caught Reality Winner, the NSA Contractor Charged With Leaking Top-Secret Materials

About an hour after The Intercept published a top-secret document stolen from the National Security Agency yesterday, the Justice Department announced the FBI had arrested a suspected leaker. The 25-year-old contractor who worked for the Pluribus International Corporation in Georgia, Reality Leigh Winner, was charged “with removing classified material from a government facility and mailing it to a news outlet.”

The document published by The Intercept details a cyber espionage campaign Russia’s military intelligence agency carried out against U.S. government organizations and an unnamed U.S. company that develops voter-registration software. The attacks occurred between August and October 2016, just before the Nov. 8 presidential election.

The operation that zeroed in on Winner as the suspect who leaked the classified materials was described by an FBI agent in an affidavit released by DOJ. On June 1, the agent wrote, the FBI was given a copy of the leaked document, which the news outlet had given to another agency, presumably NSA. That agency had verified the document was authentic, and inspected it closely.

The scanned copy of the document “appeared to be folded and/or creased,” the agent wrote, “suggesting they had been printed and hand-carried out of a secured space.” The unnamed agency then conducted an internal audit to determine who had recently printed the materials in question, and found six people who had.

“A further audit of the six individuals’ desk computers revealed that WINNER had e-mail contact with the News Outlet,” the agent wrote. “The audit did not reveal that any of the other individuals had e-mail contact with the News Outlet.”

The FBI agent spoke with Winner at her home in August, Georgia, on June 3, according to the affidavit:

During that conversation, WINNER admitted intentionally identifying and printing the classified intelligence reporting at issue despite not having a ‘need to know,’ and with knowledge that the intelligence reporting was classified. WINNER further admitted removing the classified intelligence reporting from her office space, retaining it, and mailing it from Augusta, Georgia, to the News Outlet, which she knew was not authorized to receive or possess the documents. WINNER further acknowledged that she was aware of the contents of the intelligence reporting and that she knew the contents of the reporting could be used to the injury of the United States and to the advantage of a foreign nation.

Although several news organizations have cited anonymous government sources who say the document published by The Intercept is the one Winner allegedly stole and leaked, officials have not publicly confirmed that it is. Several key details between The Intercept’s article and information released by DOJ, such as the date of the document in question, match up. Given the timing of the announcement, the link seems apparent.