NSA contractor accused of leak was undone by trail of clues


In the months after President Donald Trump was elected, Reality Leigh Winner frequently expressed outraged political views about him on social media, in between photos of her cats and favorite quotations. But on the afternoon of May 9, she posted an unusually anodyne message on Facebook, noting that she would be teaching two yoga classes that evening.  

She was harboring a secret, prosecutors say. Hours earlier, Winner, a 25-year-old former Air Force linguist who in February took a contractor job at a National Security Agency eavesdropping center in Georgia, printed out a top-secret intelligence report detailing Russian meddling in the American election and ferreted it out of the secure complex.  

Days later, she would mail the file to a reporter at the national-security news outlet The Intercept. By the time the site published the document on Monday, Winner was already under arrest — undone by a trail of clues that quickly led investigators to her. Winner, who the FBI said confessed when confronted, is now the defendant in the first criminal leak case of the Trump era.  

Her case was a reminder of the vast universe of people who have access to government secrets, largely because of the expansion of security agencies in the years since the Sept. 11 attacks. About 4 million people, both government employees and contractors, hold security clearances, including 1.3 million with top secret clearances like Winner’s.  

Among them, she was an unlikely suspect. A broader portrait that emerged from interviews and her active social media presence suggests a fun-loving, talented young woman, a workout enthusiast and a wide reader, fond of kale, dedicated to her cats and dog and her work. She had no apparent history of leaking or any disciplinary proceedings during her military service.  

On Tuesday, Winner was being held at a jail in Lincoln County, Georgia, northwest of Augusta, after an 11-minute court appearance a day earlier. A federal magistrate judge scheduled a detention hearing for Thursday.  

Her case came “totally out of left field,” said her stepfather, Gary Davis, who arrived in Georgia from Texas in recent days. She had been involved in animal rescue and service groups, Davis said in a brief interview outside Winner’s home as steady rain poured on Augusta on Tuesday.  

He added: “Reality, she’s just a good kid. She’s got a great big heart.”  

Winner had followed an older sibling into the Air Force, Davis said.  

“She looked at the Air Force and wanted to serve her country, and she did that with honors and did an exemplary job,” he said.  

Despite the swift and apparent success of the investigation, the case is the latest blow to the NSA, the nation’s largest intelligence agency, which prefers to work in the shadows and for decades largely succeeded in doing so.  

Then came a yearslong debate over warrantless wiretapping during the George W. Bush administration, the leak to the media in 2013 of hundreds of thousands of documents by Edward J. Snowden, and last year, the theft of NSA hacking tools that were made available on the web by a still-unidentified group calling itself the Shadow Brokers.  

The Snowden and Shadow Brokers leaks have deeply shaken the agency, raising the question of whether it will ever be able to protect its secrets again.  

But the prosecution of Winner may send a deterrent message to the huge, scattered workforce of employees and contractors of the NSA, showing that the authorities have sophisticated ways to track down leakers in certain circumstances.  

Winner left many clues when she took a single NSA document, a May 5 report detailing hacking by the GRU, Russian military intelligence. The report described hacks in August against a company that sells voter registration-related software and another, a few days before the election, against 122 local election officials.  

An FBI affidavit said a visible crease mark on the file, a scan of which The Intercept provided to the government while attempting to authenticate it, prompted investigators to surmise it was a printout.  

Audit trails showed six people had printed copies, but only one — Winner — had also used a work computer to exchange emails with The Intercept. A search warrant application said she had found the report by plugging keywords into the NSA’s system that fell outside her normal work duties — and had printed no other files.  

And there may have been an even more glaring telltale that the FBI did not mention in court filings. Computer security experts, including the consultant Robert Graham, have noted that color printers leave barely visible microdots identifying the serial number of the printer, the date and time of the printing, 6:20 a.m. on May 9.  

“The NSA almost certainly has a record of who used the printer at that time,” he wrote.  

Winner’s apparent Twitter feed, which used a pseudonym but had a photo of herself and the same account name as her Instagram feed, makes clear her hostility toward Trump. That suggests a possible motive for leaking: highlighting Russian hacking of election-related targets, amplifying the narrative that Trump’s victory is tainted.  

On social media — her Twitter feed went silent soon after she became an NSA contractor in February — she denounced Trump as “the orange fascist we let into the white house” and mocked Attorney General Jeff Sessions as a “Confederate.” She expressed concern about climate change, support for the Black Lives Matter movement and other liberal views.  

In response to the Iranian foreign minister, she posted on Twitter a sympathetic comment: “There are many Americans protesting US govt aggression towards Iran. If our Tangerine in Chief declares war, we stand with you!”  

On Feb. 7, she retweeted a posting by Snowden about the Trump administration’s “false claims” against the news media. On March 12, she posted on Instagram, suggesting she was listening to a podcast of the Ron Paul Liberty Report while she made a kale-intensive dinner.  

Raised in Texas, Winner received her legal name — Reality Leigh Winner — from her biological father, who, Davis said, “always wanted a real winner, so he named her Reality Leigh.”  

“The plan was to call her Leigh,” Davis said, “and one of the first baby sitters that they had started calling her Reality, and it stuck.”  

She had been living in Maryland, not far from the NSA’s main campus at Fort Meade, and she sounded a bit lonely on social media as she settled in her new home in Georgia.  

One Facebook shot, showing a cat in a guitar case, also reveals the spines of a pile of her books. They suggest her range as a linguist — a Kazakh textbook and another on Uzbek verbs — as well as her diverse interests. There’s a manual for fitness instructors, the Bhagavad Gita, the Hindu book of scripture, and several novels, including Salman Rushdie’s “The Satanic Verses.”  

Winner taught at Oh Yeah Yoga, a small studio owned by Annalisa Adams, who said attendance for her Friday evening class had grown. On Saturday night, Winner’s mother sent Adams a Facebook message and said a family emergency would indefinitely keep her daughter from teaching.  

“This is a complete shock to us,” Adams said.  

Winner lived in a small rented home about a five-minute drive from the famed Augusta National Golf Club. The house was a study in contrasts: a colorful, funky welcome mat rested out the door, and a small no trespassing sign, with a silhouette of a rifle and the words “WE DON’T CALL 911,” posted above the porch.  

Her Nissan Cube remained parked outside. One of the many stickers hailed the Sierra Club; another showed she had completed a half-marathon, and a third was an admonition: “Be truthful, gentle and fearless.”


Reader Comments ...


Next Up in Nation & World

'SNL' slams former cast member Al Franken on 'Weekend Update'
'SNL' slams former cast member Al Franken on 'Weekend Update'

"Saturday Night Live" slammed Sen. Al Franken just days after Los Angeles news anchor Leeann Tweeden accused the Minnesota Democrat and former "SNL" cast member of groping and kissing her without her consent during a 2006 USO tour. Colin Jost and Michael Che took aim at the comedian-turned-senator during the show's "Weekend...
'Project Runway' contestant Wendy Pepper dead at 53
'Project Runway' contestant Wendy Pepper dead at 53

Anne Eustis Pepper Stewart, known as Wendy Pepper, has died at the age of 53, Page Six reports. The “Project Runway” first season contestant “died peacefully" Nov. 12 while "surrounded by her loving family," according to her obituary. The news comes just one month after the death of fellow contestant...
Suspect named in Pennsylvania police officer's shooting death
Suspect named in Pennsylvania police officer's shooting death

Here’s what we know about the fatal shooting of a New Kensington, Pennsylvania, police officer: >> Read more trending news
Venus Williams' Florida home burglarized, $400,000 in goods stolen during U.S. Open
Venus Williams' Florida home burglarized, $400,000 in goods stolen during U.S. Open

The Florida residence tennis star Venus Williams calls home was burglarized as she played in the U.S. Open in September, according to a Palm Beach Gardens police report released Thursday. Though what was taken from the home at BallenIsles Country Club is redacted from the report, police indicate more than $400,000 worth of items were taken...
Heroin dealer convicted of manslaughter after buyer fatally overdoses 
Heroin dealer convicted of manslaughter after buyer fatally overdoses 

A drug dealer was convicted of involuntary manslaughter after selling heroin to a man who later died of an overdose from the opioid.  April Thomas Guthrie, 34, was also convicted of delivery of heroin and was sentenced to three to five years, according to WNCT.  Kendal Walbert died of a heroin overdose in August 2014 after buying heroin...
More Stories