Real Talk on Reality

Leaking is high risk

On June 5th The Intercept released an article based on an anonymously leaked Top Secret NSA document. The article was about one aspect of the Russian cyber campaign against the 2016 US election — the targeting of election device manufacturers. The relevance of this aspect of the Russian operation is not exactly clear, but we'll address that in a separate post because… just hours after The Intercept's article went live the US Department of Justice released an affidavit (and search warrant) covering the arrest of Reality Winner — the alleged leaker. Let's look at that!

The medium is the message

The timing of the DoJ release was clearly premeditated to send a message to would be leakers that the long arm of the law moves fast. The implied narrative is that mere hours after the leaked document was released they had already collared the leaker. Additionally, the search warrant is worded to throw as much blame on The Intercept as possible. The truth is that Ms Winner was doomed, regardless of what The Intercept did to protect their source – which was, basically, nothing.

Timeline of events

A timeline reveals that the reality is more complicated than the emerging narratives ("DoJ caught Ms Winner in hours"[0], "The Intercept grassed up their source"[1], "it is impossible to leak safely."[2])

May 5th : NSA disseminates the document

: NSA disseminates the document May 9th : Ms Winner searches for keywords that surface the document which she prints, smuggles out of the secure work facility and, "approximately a few days later," mailed to The Intercept. This was the only document she printed the entire month.

: Ms Winner searches for keywords that surface the document which she prints, smuggles out of the secure work facility and, "approximately a few days later," mailed to The Intercept. This was the only document she printed the entire month. May 24th : A reporter from The Intercept contacts a defence contractor via "text message" (probably Signal, because end to end encryption). The reporter asks the contractor to verify documents which were mailed from "Augusta, Georgia" and sends images of the docs. The reporter suggests that the documents come from Ms Winner's workplace. The contractor says the docs are fake.

: A reporter from The Intercept contacts a defence contractor via "text message" (probably Signal, because end to end encryption). The reporter asks the contractor to verify documents which were mailed from "Augusta, Georgia" and sends images of the docs. The reporter suggests that the documents come from Ms Winner's workplace. The contractor says the docs are fake. May 27–29 : Ms Winner travels to Belize.

: Ms Winner travels to Belize. May 30 : The Intercept contacts NSA for verification. They provide NSA with a copy of the document. NSA negotiates to redact certain parts to limit the exposure of sources and methods.

: The Intercept contacts NSA for verification. They provide NSA with a copy of the document. NSA negotiates to redact certain parts to limit the exposure of sources and methods. June 1st : The Intercept reporter contacts the contractor to inform them that the documents are authentic.

: The Intercept reporter contacts the contractor to inform them that the documents are authentic. June 1st : The contractor reports the media contact from The Intercept, the images of the report and the report identification number.

: The contractor reports the media contact from The Intercept, the images of the report and the report identification number. June 1st : NSA audits access logs to determine who read the document. They also, based on the copy provided by The Intercept, filter that search for people that printed the document. This gives them 6 suspects.

: NSA audits access logs to determine who read the document. They also, based on the copy provided by The Intercept, filter that search for people that printed the document. This gives them 6 suspects. June 1st : NSA examines the workstations of all 6 suspects and determine that Ms Winner had previously had a link to The Intercept — email contact. (This was on March 30th in relation to The Intercept's podcast.)

: NSA examines the workstations of all 6 suspects and determine that Ms Winner had previously had a link to The Intercept — email contact. (This was on March 30th in relation to The Intercept's podcast.) June 2nd : The FBI conducts surveillance on Ms Winner to verify her vehicle, her residence, and her mobile phone.

: The FBI conducts surveillance on Ms Winner to verify her vehicle, her residence, and her mobile phone. June 3rd : FBI interviews Ms Winner who admits to accessing and printing the document (which was in the logs), and not having a "need to know," i.e. she did not access the document as part of her job requirements. During the interview they also get her to confess to removing the printout and mailing the printout to The Intercept.