Accused NSA leaker Reality Leigh Winner left easily followed trail, FBI says

John Bacon | USA TODAY

Show Caption Hide Caption Who is Reality Winner, the accused NSA leaker? Reality Leigh Winner is the 25-year-old who has been accused of leaking classified information about Russia to the media. But who is she really? Josh King has the story (@abrigdetoland).

The investigation that led to the arrest of a federal contractor on charges of leaking classified material that was published by The Intercept website apparently was not the stuff of big-budget Hollywood spy films.

The affidavit filed Monday against Reality Leigh Winner, 25, states that federal authorities contacted the FBI on Thursday and said a "News Outlet" had reached out two days earlier relating to an upcoming story. The Intercept, which published its story Monday, apparently provided authorities with a copy of a top-secret NSA document discussing details of alleged Russian interference in U.S. elections.

Officials quickly determined the information was classified.

"The U.S. Government Agency examined the document shared by the News Outlet and determined the pages ... appeared to be folded and/or creased, suggesting they had been printed and hand-carried out of a secured space," the affidavit says.

An internal audit determined that six people had accessed and printed the intelligence report, the affidavit says.

"A further audit of the six individuals' desk computers revealed that WINNER had e-mail contact with the News Outlet," it says. "The audit did not reveal that any of the other individuals had e-mail contact with the News Outlet."

Read more:

No more phone calls, the FBI had a Winner. Unlike Edward Snowden, who fled to Hong Kong and then to Moscow after leaking classified documents, Winner was easy to chase down. FBI Special Agent Justin Garrick, based in Atlanta, spoke to her Saturday in her Augusta, Ga., home.

"During that conversation, WINNER admitted intentionally identifying and printing the classified intelligence reporting at issue despite not having a 'need to know,' and with knowledge that the intelligence reporting was classified," the affidavit says.

It adds that Winner, who had "Top Secret" clearance while working as a contractor with Pluribus International Corp., admitted taking the classified report from her office space and mailing it to the news outlet, even though she knew the website was not authorized to receive or possess the documents. The complaint claims Winner even acknowledged that she "knew the contents of the reporting could be used to the injury of the United States and to the advantage of a foreign nation."

The Intercept says the NSA document details the Russian "spear-fishing" attack targeting local government employees with emails that appeared to be from e-voting vendors but were designed to allow hackers to infect and gain control of computers.

In late October, the hackers sent emails to 122 addresses tied to "local government organizations," the document says, adding that "officials involved in the management of voter registration systems" were the likely targets.

"It is unknown whether the aforementioned spear-phishing deployment successfully compromised all the intended victims, and what potential data could have been accessed by the cyber actor," the alleged NSA document says. "However, based upon subsequent targeting, it was likely that at least one account was compromised."

The Intercept issued a statement Tuesday saying it obtained the report anonymously and did not know the source until the news broke late Monday.

"It is important to keep in mind that these (charging) documents contain unproven assertions and speculation designed to serve the government’s agenda and as such warrant skepticism," the statement said. "Winner faces allegations that have not been proven. The same is true of the FBI’s claims about how it came to arrest Winner."

Contributing: Kevin Johnson