How The NSA And FBI Tracked Down The Air Force Vet Who Leaked A Top Secret Russia Hacking Report
By going over printing histories and work computer data, the National Security Agency and the Federal Bureau of Investigation was...

By going over printing histories and work computer data, the National Security Agency and the Federal Bureau of Investigation was able to trace a leaked report on the Russia investigation to 25-year-old Air Force veteran and federal contractor Reality Leigh Winner.
On June 3, Winner was arrested on charges of leaking top-secret intelligence about an NSA report on Russia's involvement in the 2016 election to The Intercept.
According to the document, Russian military intelligence launched an attack on at least one U.S. voting-software supplier and sent so-called spear-phishing emails to at least 100 local election officials shortly before the election. It is the strongest public indication so far that Russia interfered in the US election.
The NSA started investigating the leak when, on May 30, a journalist from The Intercept asked the agency to comment on the printed report, which appeared to be folded and creased, theWashington Post reports.
An affidavit of the investigation claims that six people had printed out the document — and Winner was one of them. As a contractor for the NSA with Pluribus International Corporation, Winner held top security clearance.
After searching her work computer, according to the affidavit, NSA and FBI investigators discovered that Winner had emailed the document to The Intercept from her private email, asking for podcast transcripts in the message. Investigators also found that, on May 9, Winner searched the agency's computer system for the classified document and printed it out in the office.
“Because the NSA logs all printing jobs on its printers, it can use this to match up precisely who printed the document,” security expert Rob Graham wrote for the blog Errata Security. The printed documents have small yellow dots that help track where any document was printed, he wrote.
So I wrote up a blogpost explaining how secret dots printers put on documents outed NSA leaker Reality Winner.https://t.co/dEyDVmAYDF pic.twitter.com/jirvntXQyl
— Robᵉʳᵗ Graham💰 @erratarob@infosec.exchange (@ErrataRob) June 6, 2017
WikiLeaks accused the journalists at The Intercept of helping the NSA track Winner down so fast, because they handed over the printed documents.
Suspected Intercept reporter gave US government NSA whistleblower Reality Leigh Winner's post code, printout and her report number: pic.twitter.com/vW4RtQGSO6
— WikiLeaks (@wikileaks) June 6, 2017
On June 1, another government contractor told the NSA that a reporter texted him pictures of the document to confirm whether it was real, and that the journalist said the documents were mailed from Augusta, Georgia.
Investigators then found Winner's house in Augusta and arrested her while she was at home. Winner has since admitted to mailing the document and is in jail in advance of her trial.
More from Business Insider:
- The FBI thinks it's found the person who leaked top secret intelligence about Russia
- 'This is huge': National security experts were floored by the leaked NSA document on Russian election hack
- Cities push back as Trump aims to cut $156 million in anti-terrorism funding
- These are the fighter jets leading the air war against ISIS
- The 25-year-old accused of leaking top-secret NSA document talked of 'standing' with Iran in hypothetical war with U.S.