ABOUT POST
Miller: They are going to want any computers, phones, hard drives, thumb drives, discs, gaming systems, printers, basically anything that could store data. They are going to look for notes, writings, papers, and documents. They are going to look for other things — the hunting magazine or the nail clippers, those things that were seen on the bed where it appears the pictures of documents were taken. If the bedspread matches the one that was in the background of some of the pictures of documents, they’ll take that too.
WATCH HERE
So how was the suspect caught?
Miller: You had two fields of investigation here. One was on social media. How could you trace these documents back from Twitter to Discord to a private chatroom with a limited number of participants? That means serving Discord with orders to preserve these records so users can't delete them. That means getting subpoenas and search warrants for the contents of that chatroom. That takes some time because you have to show probable cause. The FBI was able to convince a reluctant witness who was a member of the chat group to cooperate and that helped move this process forward
The Washington Post was able to exploit that end of the case and talk to a member of the chat group who wouldn’t name the leader who posted the documents. The New York Times published his name before he was arrested, but that’s reporting, not evidence.
The DOD, FBI and OSI, the Air Force Office of Special Investigations explored those same paths, but they also did things reporters and online gamers and sleuths couldn’t do — they pulled logs. Who looked at those documents? Who, in a classified setting, read those reports and then sent them to a classified printer that logs every document it prints with a time stamp and the computer that sent the request. The computer records the chip of the ID card and the login of the user that pulled up the document to print it. They quickly narrowed a large number of possibilities to a very small number and zeroed in on this 21-year-old airman over the last 48 hours. One of the complicating factors was, reporters did too.