A probe into the leak of secret US documents likely will require investigators to examine those who had access and scrutinize details like objects captured in photos of the materials, former US officials told Reuters, as pressure grows to find the person or group responsible.
The Department of Justice opened a formal criminal probe last week after the matter was referred by the Pentagon, which is assessing the damage done by what may be the most damaging release of classified US information in years.
Reuters has reviewed more than 50 of the documents, labeled "Secret" and "Top Secret" but has not independently verified their authenticity.
Two former US officials told Reuters that one of the investigators' first steps would be reviewing who had access to the dozens of documents, photographs of which were posted on social media platforms last month, or possibly earlier.
One potential clue: a number of documents are embossed with the Joint Chiefs of Staff emblem and one document is purportedly a daily intelligence update for the chairman of the Joint Chiefs of Staff and the secretary of defense. This could help investigators focus their effort, though many people could have had access to these documents.
Some images also depict printouts of documents with time stamps at the top right corners showing when they were printed.
That could be a key indicator because government classified computer systems keep logs of those who view and print documents, said Mark Zaid, a lawyer who practices national security law.
Not the 'perfect crime'?
A former federal prosecutor, speaking on the condition of anonymity, said that once investigators narrow the list of people with access to the materials, they could seek "pen registers" that would show a history of outgoing phone calls made without revealing their content.
They also could try obtaining search warrants for electronic cloud accounts and electronic devices, potentially giving access to private messages and documents.
Michael Atkinson, the US Intelligence Community inspector general until 2020, said investigators may be able to discover the leaker's electronic fingerprints, given the large number of leaked documents along with the fact that they were shared on online forums.
"I think this one will probably be solved," said Atkinson, who also worked at the Department of Justice. "This does not look to me to be the perfect crime."
Others are less confident.
Daniel Hoffman, a former senior CIA undercover officer, said that if the release of documents was part of a misinformation effort by Russia or another country, those responsible could have deliberately inserted misleading clues, including fake time stamps.
"This is going to be a big challenge to get to the bottom of whatever happened. We may never know (who leaked the documents)," said Hoffman.
The Pentagon referred questions on the investigation to the Department of Justice and a spokesperson for the DOJ had no comment beyond Friday’s statement announcing that it was investigating the leak.
US Defense Secretary Lloyd Austin on Tuesday said the United States will "turn over every rock" to find the source of the leak.
Glue, scope and clippers
There could be clues in the photos themselves. One of the leaked documents rests on a table and in the right corner of the picture is what appears to be a bottle of Gorilla super glue. On the left is a book with an image resembling a hunting rifle scope and there is what appears to be a pair of nail clippers at the top of the photo.
But, as with time stamps and other details, investigators will need to be wary of deliberate attempts to sow confusion.
US officials told Reuters on Sunday that they have not ruled out the possibility that the documents may have been doctored.
While leak investigations can take months or even years, investigators face intense pressure to find the source of this security breach given the possibility that more documents could be leaked.
Officials have told Reuters that the breadth of topics addressed in the documents, which touch on the war in Ukraine, as well as China, the Middle East and Africa, suggest they may have been leaked by an American rather than an ally.
Investigators were considering a number of theories, from someone who misplaced the documents to an insider who actively wanted to undermine US national security interests, a US official told Reuters.
White House spokesperson John Kirby told reporters on Tuesday that it was "difficult to know" when officials will know the origin of the documents.