Clues Left Online Might Aid Leak Investigation, Officials Say

WASHINGTON — A surprisingly large number of people potentially had access to the Pentagon intelligence documents leaked on a social media site in early March, but clues left online may help investigators narrow down the pool of possible suspects relatively quickly, U.S. officials said on Monday.

A series of critical questions hinge on the investigation: not just who took the documents and posted them online, but also why and what kind of damage the release of the material might have done.

“We don’t know who is behind this; we don’t know what the motive is,” said John F. Kirby, the National Security Council spokesman. “We don’t know what else might be out there.”

Officials at the White House, the Justice Department and the Pentagon said little on Monday about the investigation into the leaked materials, which appear to detail national security secrets on Ukraine, Russia and a range of other countries.

While some documents were doctored, those revisions appear to have been made later. Officials have acknowledged that many of the documents are genuine, and they were initially posted on the internet without alterations.

Determining a motive might be difficult in part because the classified material highlighted weaknesses in the militaries of both Ukraine and Russia, and could potentially damage America’s ability to collect information in the future.

It is possible, former officials said, that the motivation might not have been overtly political, but those questions will be answered only as the investigation continues.

The intelligence materials appear to have been first photographed and then uploaded online, a kind of sloppy procedure that suggests the person leaking the documents probably took few steps to conceal the IP addresses used or the date stamps from photographs, said Javed Ali, a former senior U.S. counterterrorism official who held intelligence roles at the F.B.I., the Defense Intelligence Agency and the Department of Homeland Security.

A senior U.S. official said hundreds, if not thousands, of military and other U.S. government officials have the security clearances needed to gain access to the documents.

The official said the military’s Joint Staff instituted procedures last Friday to limit the distribution of highly sensitive briefing documents and restrict attendance at meetings where briefing books containing paper copies of the documents were available.

Officials said it was too soon to determine whether the disclosure of the documents would hurt America’s ability to collect information inside Russia.

A senior U.S. military official said that as of late Saturday, there were no indications that Russia had plugged any of the information leaks that U.S. and other Western intelligence services had tapped into, and passed on to Ukrainian officials to help them strike Russian targets.

That suggested that Russia, like senior Pentagon officials, only recently learned of the disclosures even though the files had sat on Discord, a social media messaging platform, since early March, analysts said.

Christopher Meagher, the chief Pentagon spokesman, declined to answer most questions about the investigation, citing a criminal inquiry started by the Justice Department and the F.B.I.

The Pentagon is leading a separate interagency team, including the White House, the State Department and intelligence agencies, to determine the damage caused by the disclosures, and to assess what more needs to be done to address the leak.

“That includes taking steps to take a closer look at exactly how this type of information is distributed and to whom,” Mr. Meagher said, “but beyond that, I’m not going to get into any more specifics.”

Mr. Meagher said that Defense Secretary Lloyd J. Austin III was initially briefed on the leak last Thursday morning. The next day, Mr. Austin began convening departmentwide meetings to address the growing disclosures.

“The secretary and Department of Defense and the United States government take this apparent unauthorized disclosure extremely seriously,” Mr. Meagher said. “This is a top priority for us.”

Mr. Meagher said Pentagon and other U.S. officials began contacting congressional leaders and allies over the weekend to alert them to the leaks, which have already complicated relations with some countries.

“The reports of intelligence leaks are incredibly concerning,” Representative Mike D. Rogers of Alabama, the chairman of the House Armed Services Committee, said in a statement on Monday. Mr. Rogers said the panel was “actively seeking answers from the Department of Defense.”

Mr. Ali said the classified materials that were disclosed would have been electronically contained in stand-alone computer systems that are not connected to the broader internet. The computers reside in secure work areas known as SCIFs — Sensitive Compartmented Information Facilities — where no one is allowed to bring in any electronic devices that could be used to take photographs or make video or audio recordings.

Anyone involved in the production of these daily products would have been cleared at the highest levels, he said.

“While these protocols might help narrow the pool of individuals who could have been responsible, it will still entail a major investigative process where hundreds or thousands of people will have to be interviewed,” said Mr. Ali, who is now at the University of Michigan’s Gerald R. Ford School of Public Policy.

That the intelligence materials appear to have been first photographed and then uploaded online may help investigators forensically determine the points of origin of such activity by tracking IP addresses and date/time stamps from photographs unless efforts were made to conceal these signatures, Mr. Ali said.

A former senior F.B.I. official with extensive experience in national security issues said on Monday that investigators would first seek to identify the universe of government personnel and government contractors who had access to the documents.

Investigators would then try to pinpoint any of the documents that are unique to a smaller group of recipients, which might help narrow the inquiry, the official said. After that, the process of elimination begins.

“Sometimes a leaker makes a mistake when leaking with photographs or an electronic fingerprint,” the official said. “This will be a very tough one.”

The documents included information about intelligence that the United States had gathered on allies including South Korea and Israel and partners like Ukraine. Mr. Kirby declined to answer specific questions but said simply that “U.S. officials have been in touch with relevant allies and partners.”