In the months after President Donald Trump was elected, Reality Leigh Winner frequently expressed outraged political views about him on social media, in between photos of her cats and favorite quotations. But on the afternoon of May 9, she posted an unusually anodyne message on Facebook, noting that she would be teaching two yoga classes that evening.
She was harboring a secret, prosecutors say. Hours earlier, Winner, a 25-year-old former Air Force linguist who in February took a contractor job at a National Security Agency eavesdropping center in Georgia, printed out a top-secret intelligence report detailing Russian meddling in the American election and ferreted it out of the secure complex.
Days later, she would mail the file to a reporter at the national-security news outlet The Intercept. By the time the site published the document on Monday, Winner was already under arrest — undone by a trail of clues that quickly led investigators to her. Winner, who the FBI said confessed when confronted, is now the defendant in the first criminal leak case of the Trump era.
Her case was a reminder of the vast universe of people who have access to government secrets, largely because of the expansion of security agencies in the years since the Sept. 11 attacks. About 4 million people, both government employees and contractors, hold security clearances, including 1.3 million with top secret clearances like Winner’s.
Among them, she was an unlikely suspect. A broader portrait that emerged from interviews and her active social media presence suggests a fun-loving, talented young woman, a workout enthusiast and a wide reader, fond of kale, dedicated to her cats and dog and her work. She had no apparent history of leaking or any disciplinary proceedings during her military service.
On Tuesday, Winner was being held at a jail in Lincoln County, Georgia, northwest of Augusta, after an 11-minute court appearance a day earlier. A federal magistrate judge scheduled a detention hearing for Thursday.
Her case came “totally out of left field,” said her stepfather, Gary Davis, who arrived in Georgia from Texas in recent days. She had been involved in animal rescue and service groups, Davis said in a brief interview outside Winner’s home as steady rain poured on Augusta on Tuesday.
He added: “Reality, she’s just a good kid. She’s got a great big heart.”
Winner had followed an older sibling into the Air Force, Davis said.
“She looked at the Air Force and wanted to serve her country, and she did that with honors and did an exemplary job,” he said.
Despite the swift and apparent success of the investigation, the case is the latest blow to the NSA, the nation’s largest intelligence agency, which prefers to work in the shadows and for decades largely succeeded in doing so.
Then came a yearslong debate over warrantless wiretapping during the George W. Bush administration, the leak to the media in 2013 of hundreds of thousands of documents by Edward J. Snowden, and last year, the theft of NSA hacking tools that were made available on the web by a still-unidentified group calling itself the Shadow Brokers.
The Snowden and Shadow Brokers leaks have deeply shaken the agency, raising the question of whether it will ever be able to protect its secrets again.
But the prosecution of Winner may send a deterrent message to the huge, scattered workforce of employees and contractors of the NSA, showing that the authorities have sophisticated ways to track down leakers in certain circumstances.
Winner left many clues when she took a single NSA document, a May 5 report detailing hacking by the GRU, Russian military intelligence. The report described hacks in August against a company that sells voter registration-related software and another, a few days before the election, against 122 local election officials.
An FBI affidavit said a visible crease mark on the file, a scan of which The Intercept provided to the government while attempting to authenticate it, prompted investigators to surmise it was a printout.
Audit trails showed six people had printed copies, but only one — Winner — had also used a work computer to exchange emails with The Intercept. A search warrant application said she had found the report by plugging keywords into the NSA’s system that fell outside her normal work duties — and had printed no other files.
And there may have been an even more glaring telltale that the FBI did not mention in court filings. Computer security experts, including the consultant Robert Graham, have noted that color printers leave barely visible microdots identifying the serial number of the printer, the date and time of the printing, 6:20 a.m. on May 9.
“The NSA almost certainly has a record of who used the printer at that time,” he wrote.
Winner’s apparent Twitter feed, which used a pseudonym but had a photo of herself and the same account name as her Instagram feed, makes clear her hostility toward Trump. That suggests a possible motive for leaking: highlighting Russian hacking of election-related targets, amplifying the narrative that Trump’s victory is tainted.
On social media — her Twitter feed went silent soon after she became an NSA contractor in February — she denounced Trump as “the orange fascist we let into the white house” and mocked Attorney General Jeff Sessions as a “Confederate.” She expressed concern about climate change, support for the Black Lives Matter movement and other liberal views.
In response to the Iranian foreign minister, she posted on Twitter a sympathetic comment: “There are many Americans protesting US govt aggression towards Iran. If our Tangerine in Chief declares war, we stand with you!”
On Feb. 7, she retweeted a posting by Snowden about the Trump administration’s “false claims” against the news media. On March 12, she posted on Instagram, suggesting she was listening to a podcast of the Ron Paul Liberty Report while she made a kale-intensive dinner.
Raised in Texas, Winner received her legal name — Reality Leigh Winner — from her biological father, who, Davis said, “always wanted a real winner, so he named her Reality Leigh.”
“The plan was to call her Leigh,” Davis said, “and one of the first baby sitters that they had started calling her Reality, and it stuck.”
She had been living in Maryland, not far from the NSA’s main campus at Fort Meade, and she sounded a bit lonely on social media as she settled in her new home in Georgia.
One Facebook shot, showing a cat in a guitar case, also reveals the spines of a pile of her books. They suggest her range as a linguist — a Kazakh textbook and another on Uzbek verbs — as well as her diverse interests. There’s a manual for fitness instructors, the Bhagavad Gita, the Hindu book of scripture, and several novels, including Salman Rushdie’s “The Satanic Verses.”
Winner taught at Oh Yeah Yoga, a small studio owned by Annalisa Adams, who said attendance for her Friday evening class had grown. On Saturday night, Winner’s mother sent Adams a Facebook message and said a family emergency would indefinitely keep her daughter from teaching.
“This is a complete shock to us,” Adams said.
Winner lived in a small rented home about a five-minute drive from the famed Augusta National Golf Club. The house was a study in contrasts: a colorful, funky welcome mat rested out the door, and a small no trespassing sign, with a silhouette of a rifle and the words “WE DON’T CALL 911,” posted above the porch.
Her Nissan Cube remained parked outside. One of the many stickers hailed the Sierra Club; another showed she had completed a half-marathon, and a third was an admonition: “Be truthful, gentle and fearless.”