REUTERS/Larry Downing
The founder of the protest group Code Pink Medea Benjamin (L) and a protester in a mask depicting U.S. President Barack Obama character as she protests against Obama and NSA before his arrival at the Department of Justice in Washington, January 17, 2014.
By going over printing histories and work computer data, the National Security Agency and the Federal Bureau of Investigation was able to trace a leaked report on the Russia investigation to 25-year-old Reality Leigh Winner.On June 3, Winner was arrested on charges of leaking top-secret intelligence about an NSA report on Russia's involvement in the 2016 election to The Intercept.
According to the document, Russian military intelligence launched an attack on at least one US voting-software supplier and sent so-called spear-phishing emails to at least 100 local election officials shortly before the election. It is the strongest public indication so far that Russia interfered in the US election.
The NSA started investigating the leak when, on May 30, a journalist from The Intercept asked the agency to comment on the printed report, which appeared to be folded and creased, the Washington Post reports.
An affidavit of the investigation claims that six people had printed out the document - and Winner was one of them. As a contractor for the NSA with Pluribus International Corporation, Winner held top security clearance.
After searching her work computer, according to the affidavit, NSA and FBI investigators discovered that Winner had emailed the document to The Intercept from her private email, asking for podcast transcripts in the message. Investigators also found that, on May 9, Winner searched the agency's computer system for the classified document and printed it out in the office.
"Because the NSA logs all printing jobs on its printers, it can use this to match up precisely who printed the document," security expert Rob Graham wrote for the blog Errata Security. The printed documents have small yellow dots that help track where any document was printed, he wrote.
WikiLeaks accused the journalists at The Intercept of helping the NSA track Winner down so fast, because they handed over the printed documents.
On June 1, another government contractor told the NSA that a reporter texted him pictures of the document to confirm whether it was real, and that the journalist said the documents were mailed from Augusta, Georgia.
Investigators then found Winner's house in Augusta and arrested her while she was at home. Winner has since admitted to mailing the document and is in jail in advance of her trial.
Suspected Intercept reporter gave US government NSA whistleblower Reality Leigh Winner's post code, printout and her report number: pic.twitter.com/vW4RtQGSO6
- WikiLeaks (@wikileaks) June 6, 2017