New batch of classified U.S. documents appear on social media sites

BY HELENE COOPER, JULIAN E. BARNES, ERIC SCHMITT AND THOMAS GIBBONS-NEFF, THE NEW YORK TIMES,

A new batch of classified documents that appear to detail U.S. national security secrets from Ukraine to the Middle East to China surfaced on social media sites Friday, alarming the Pentagon and adding turmoil to a situation that seemed to have caught the Biden administration off guard.

The scale of the leak — analysts say more than 100 documents may have been obtained — along with the sensitivity of the documents themselves, could be hugely damaging, U.S. officials said. A senior intelligence official called the leak “a nightmare for the Five Eyes,” in a reference to the United States, Britain, Australia, New Zealand and Canada, the so-called Five Eyes nations that broadly share intelligence.

The latest documents were found on Twitter and other sites Friday, a day after senior Biden administration officials said they were investigating a potential leak of classified Ukrainian war plans, include an alarming assessment of Ukraine’s faltering air defense capabilities. One slide, dated Feb. 23, is labeled “Secret/NoForn,” meaning it was not meant to be shared with foreign countries.

Mick Mulroy, a former senior Pentagon official, said the leak of the classified documents represents “a significant breach in security” that could hinder Ukrainian military planning. “As many of these were pictures of documents, it appears that it was a deliberate leak done by someone that wished to damage the Ukraine, U.S., and NATO efforts,” he said.

One analyst described what has emerged so far as the “tip of the iceberg.”

Early Friday, senior national security officials dealing with the initial leak, which was first reported by The New York Times, said a new worry had arisen: Was that information the only intelligence that was leaked?

By Friday afternoon, they had their answer. Even as officials at the Pentagon and national security agencies were investigating the source of documents that had appeared on Twitter and on Telegram, another surfaced on 4chan, an anonymous, fringe message board. The 4chan document is a map that purports to show the status of the war in the eastern Ukrainian city of Bakhmut, the scene of a fierce, monthslong battle.

But the leaked documents appear to go well beyond highly classified material on Ukraine war plans. Security analysts who have reviewed the documents tumbling onto social media sites say the increasing trove also includes sensitive briefing slides on China, the Indo-Pacific military theater, the Middle East and terrorism.

The Pentagon said in a statement Thursday that the Defense Department was looking into the matter. On Friday, as the disclosures widened, department officials said they had nothing to add. But privately, officials in several national security agencies acknowledged both a rush to find the source of the leaks and a potential for what one official said could be a steady drip of classified information posted on sites.

The documents on Ukraine’s military appear as photographs of charts of anticipated weapons deliveries, troop and battalion strengths, and other plans. Pentagon officials acknowledge that they are legitimate Defense Department documents, but the copies appear to have been altered in certain parts from their original format. The modified versions, for example, overstate U.S. estimates of Ukrainian war dead and underestimate estimates of Russian troops killed.

On Friday, Ukrainian officials and pro-war Russian bloggers suggested the leak was part of a disinformation effort by the other side, timed to influence Ukraine’s possible spring offensive to reclaim territory in the east and the south of the country.

A senior Ukrainian official said that the leak appeared to be a Russian ploy to discredit a counteroffensive. And the Russian bloggers warned against trusting any of the information, which one blogger said could be the work of “Western intelligence in order to mislead our command.”

Behind closed doors, chagrined national security officials were trying to find the culprit. One official said it was likely that the documents did not come from Ukrainian officials, because they did not have access to the specific plans, which bear the imprint of the offices of the Pentagon’s Joint Staff. A second official said that determining how the documents were leaked would start with identifying which officials had access to them.

The first tranche of documents appeared to have been posted in early March on Discord, a social media chat platform popular with video gamers, according to Aric Toler, an analyst at Bellingcat, the Dutch investigative site.

In Ukraine, Lt. Col. Yurii Bereza, a battalion commander with Ukraine’s national guard whose forces have fought in the country’s east in recent months, shrugged off news of the leak.

He noted that information warfare had become so intense that “we can no longer determine where is the truth and where is the lie.”

“We are at that stage of the war when the information war is sometimes even more important than the direct physical clashes at the front,” Bereza said.

A soldier in his unit, Maksym, had yet to hear the news. “We have a lot of our own problems, and with this leak I have no words,” he said angrily.

Outside experts said it was difficult to draw conclusions about who released the information and why.

Kyle Walter, the head of research at Logically, a British firm that tracks disinformation, said many prominent voices on Russian Telegram channels were calling the original, apparently unaltered photo showing Russian and Ukrainian casualties a “Western influence” operation.

“They think the actual unedited photo where it shows high Russian loss numbers and relatively low Ukrainian loss numbers is an attempt to instill poor morale in Russia and Russian forces,” Walter said.

Jonathan Teubner, CEO of FilterLabs AI, which tracks messaging in Russia, said that while pro-Kremlin voices were saying the leak was an American or Ukrainian disinformation campaign, his lead analyst thought it could be a Russian operation meant to sow distrust between the U.S. and Ukraine.

The doctored photo showing lower casualty numbers for Russia, and higher ones for Ukraine, than reported figures has been discussed far more frequently in Western-oriented social media than in Russian-focused platforms, Walter said.

It has been a frequent Russian disinformation tactic to alter stolen documents, including some purportedly leaked from the Ukrainian government, Walter said. But because Ukraine’s government has dismissed these documents as altered or out of context, they generally do not gain much traction, he added.

“There are a lot of examples of leaked documents being used in propaganda campaigns and specifically in terms of disinformation,” Walter said. But what is going on with these American documents, he added, “is still pretty unclear at the moment.”

The Ukraine war, Walter said, has had more document leaks than other conflicts, in part because of the role that open-source intelligence and declassified intelligence have played in the war.

“There’s definitely been an uptick, it’s happening more often, but that’s more indicative of just the environment we’re in rather than it being the tactic specific to the Ukraine war,” Walter said.

Leaked documents reveal depth of U.S. spy efforts and Russia’s military struggles

BY JULIAN E. BARNES, HELENE COOPER, THOMAS GIBBONS-NEFF, MICHAEL SCHWIRTZ AND ERIC SCHMITT, THE NEW YORK TIMES

A trove of leaked Pentagon documents reveals how deeply Russia’s security and intelligence services have been penetrated by the United States, demonstrating Washington’s ability to warn Ukraine about planned strikes and providing an assessment of the strength of Moscow’s war machine.

The documents paint a portrait of a depleted Russian military that is struggling in its war in Ukraine and of a military apparatus that is deeply compromised. They contain daily real-time warnings to U.S. intelligence agencies on the timing of Moscow’s strikes and even its specific targets. Such intelligence has allowed the United States to pass on to Ukraine crucial information on how to defend itself.

The documents lay bare the American assessment of a Ukrainian military that is also in dire straits. The documents, from late February and early March but found on social media sites in recent days, outline critical shortages of air defense munitions and discuss gains being made by Russian troops around the eastern city of Bakhmut. The intelligence reports show that the United States also appears to be spying on Ukraine’s top military and political leaders, a reflection of Washington’s struggle to get a clear view of Ukraine’s fighting strategies.

The material reinforces an idea that intelligence officials have long acknowledged: The United States has a clearer understanding of Russian military operations than it does of Ukrainian planning. Intelligence collection is often difficult and sometimes wrong, but the trove of documents offers perhaps the most complete picture yet of the inner workings of the largest land war in Europe in decades.

American officials said that although the documents offer hints about U.S. methods to collect information on Russian plans, U.S. intelligence agencies do not yet know if any of their sources of information will be cut off as a result of the leak. U.S. officials have conceded they have lost some sources of information since the war began, but the new documents appear to show that America’s understanding of Russian planning remains extensive.

But the leak has the potential to do real damage to Ukraine’s war effort by exposing which Russian agencies the United States knows the most about, giving Moscow a potential opportunity to cut off information sources.

The leak has complicated relations with allied countries and raised doubts about America’s ability to keep its secrets. After reviewing the documents, a senior Western intelligence official said the release of the material was painful and suggested that it could curb intelligence sharing. For various agencies to provide material to each other, the official said, requires trust and assurances that certain sensitive information will be kept secret.

The documents could also hurt diplomatic ties in other ways. The newly revealed intelligence documents also make plain that the U.S. is not just spying on Russia, but also its allies. While that will hardly surprise officials, making such eavesdropping public always hampers relations with key partners, such as South Korea, whose help is needed to supply Ukraine with weaponry.

Senior U.S. officials said an inquiry, launched Friday by the FBI, would try to move swiftly to determine the source of the leak. The officials acknowledged that the documents appear to be legitimate intelligence and operational briefs compiled by the Pentagon’s Joint Staff, using reports from the government’s intelligence community, but that at least one had been modified from the original at some later point.

One senior U.S. official called the leak “a massive intelligence breach,” made worse because it lays out to Russia just how deep American intelligence operatives have managed to get into the Russian military apparatus. Officials within the U.S. government with security clearance often receive such documents through daily emails, one official said, and those emails might then be automatically forwarded to others.

Another senior U.S. official said tracking down the original source of the leak could be difficult because hundreds, if not thousands, of military and other U.S. government officials have the security clearances needed to gain access to the documents. The official said the Pentagon had instituted procedures in the past few days to “lock down” the distribution of highly sensitive briefing documents. The documents posted online were photographs of folded papers, some with images of a magazine behind them, information that may help investigators.

The documents show that nearly every Russian security service appears penetrated by the United States in some way. For example, one entry, marked top secret, discusses the Russian General Staff’s plans to counter the tanks NATO countries were providing to Ukraine, including creating different “fire zones” and beginning training of Russian soldiers on the vulnerabilities of different allied tanks.

Another entry talks about an information campaign being planned by the GRU, Russia’s military intelligence unit, in Africa trying to shape public opinion against the United States and “promote Russian foreign policy.”

While some intelligence briefs offer analysis and broad warnings of Russian plans, others are the kind of actionable information that Ukraine could use to defend itself. One entry talks about the Russian Defense Ministry formulating plans to conduct missile strikes on Ukraine’s forces at specific sites in Odesa and Mykolaiv on March 3, an attack that the U.S. intelligence agencies believed would be designed to destroy a drone storage area and an air defense gun and to kill Ukrainian soldiers.

Still another entry discusses a report in February disseminated by Russia’s National Defense Command Center about the “decreased combat capability” of Russia’s forces in Eastern Ukraine.

Although the documents were compiled by the Pentagon’s Joint Staff, they contain intelligence from many agencies, including the National Security Agency, the State Department’s Bureau of Intelligence and Research, and the CIA. Some of the material is labeled as having been collected under the Foreign Intelligence Surveillance Act (FISA), noting that its further distribution is not allowed without permission of the attorney general.

One section of the documents is labeled as being the CIA Operations Center Intelligence Update from March 2. That section discusses intelligence on how the Russian Ministry of Defense had considered steps to counter accusations that it had not been supplying munitions to Wagner group troops in Ukraine “according to a signals intelligence report.”

The documents reveal that American intelligence services are not only spying on the Russians, but are also eavesdropping on important allies.

In the pages posted online, there are at least two discussions about South Korea’s debate about whether to give the U.S. artillery shells for use in Ukraine, violating Seoul’s policy on providing lethal aid. One section of the documents reports that South Korean officials were worried that President Joe Biden would call South Korea’s president pressuring Seoul to deliver the goods.

Another section of the documents, from the CIA, is more explicit about how the United States has learned about the South Korean deliberations, noting the information was from “a signals intelligence report.”