Published: 16:47 BST, 14 April 2023 | Updated: 20:54 BST, 14 April 2023
Journalists appeared to be ahead of the curve in investigating the recent leak of highly classified Pentagon documents, publicly disclosing the leak and tracing its source before the DOJ announced charges in the case.
Air Force National Guardsman Jack Douglas Teixeira, 21, was arrested by FBI in Massachusetts on Thursday, over an hour after the New York Times and Bellingcat journalist Aric Toler identified him as the suspected leaker.
Court documents unsealed on Friday morning indicate that the FBI had identified Teixeira as a suspect at least by Wednesday, using witness statements and billing records from the messaging service Discord.
Bellingcat, an open-source investigation website that relies on public information to research a variety of subjects, was the first to publicly identify the Discord chatroom ‘Thug Shaker Central,’ where Teixeira allegedly posted classified documents under the username ‘The OG.’
In a Bellingcat article last week, Toler meticulously traced the documents to their original source, after they had spread on pro-Russian Telegram channels, the website 4Chan, and multiple Discord servers.
US officials are still assessing the damage inflicted by the leaks, which included secret records detailing Ukrainian military vulnerabilities, and classified information about allies including Israel, South Korea and Turkey.
Bellingcat journalist Aric Toler (left) was the first to publicly identify the source of the leaked documents, the ‘Thug Shaker Central’ Discord chatroom where Jack Teixeira (right) allegedly posted them as early as December 2022
The documents appeared to have circulated online for months before they were brought to public attention by a New York Times article on April 6, which first reported the Pentagon was investigating a breach.
The Pentagon has said that Secretary of Defense Lloyd Austin was initially briefed on the leak on the morning of April 6, and launched a cross-department investigation.
On April 9, Toler, Bellingcat’s Director of Training and Research, posted his article tracing the provenance of the documents back to their original source.
He noted that photographs of the documents first spread widely on pro-Russian Telegram channels on April 5, where they appeared to have been crudely altered to cast Russia’s invasion of Ukraine in a more positive light.
Hours prior to that, other documents had been shared on the imageboard website 4Chan, with only one of the images in common with the Telegram posts, suggesting a separate original source.
Bellingcat identified the probable source as a March 4 post of 10 documents to a Discord server dedicated to the Minecraft game, which included all seven of the documents from the 4chan and Telegram posts.
Those documents appeared to be from a batch of over 30 documents shared by a user of the ‘WowMao’ Discord server on March 1 and 2.
From there, Toler was able to provisionally identify another Discord chatroom, ‘Thug Shaker Central’ as the original source of the leaks, dating all the way back to January 13.
Photographs of the documents first spread widely on pro-Russian Telegram channels (above) on April 5, where they appeared to have been crudely altered
Hours prior to the Telegram post, other documents had been shared on the imageboard website 4Chan, with only one of the images in common with the Telegram posts
Bellingcat identified the probable source of the Telegram and 4Chan posts as a March 4 post of 10 documents to a Discord server dedicated to the Minecraft game
A TV screen shows a news program reporting on the leaked Pentagon documents at the Seoul Railway Station in South Korea on Wednesday
Discord is a messaging service which is invite-only and encrypted – meaning data is concealed by being converted into code.
The platform can only be accessed with a log-in and password with chat groups known as ‘servers’ – of which many remain small and exclusive.
Any Discord user is able to start a server for free and invite their friends.
There are also larger, more open communities, which usually focus on specific topics such as popular games like Minecraft and Fortnite.
The app estimates it is being used worldwide by tens of millions aged 13+.
Discord says the server is: ‘A place where they can be themselves and spend time with other people who share their interests and hobbies’.
Though Thug Shaker Central had since been deleted, screenshots and interviews with participants in the chatroom led to the identification of the chatroom’s administrator, known by the screenname The OG, as the leaker.
On Thursday, the New York Times identified Teixeira as The OG about 90 minutes before the FBI descended on his home in North Dighton, Massachusetts and arrested him without incident, according to an article including Toler’s byline.
Charging documents unsealed on Friday alleged that Teixeira began posting classified documents to Thug Shaker Central as early as December 2022, meaning they could have circulated for months before authorities were aware.
It is believed to be the most serious security breach since more than 700,000 documents, videos and diplomatic cables appeared on the WikiLeaks website in 2010.
In the WikiLeaks case, the leaker – US Army Private First Class Chelsea Manning – was sentenced to 35 years in prison. President Barack Obama later commuted her sentence.
But unlike Manning, and Edward Snowden in his massive 2013 leak of classified NSA documents, Teixeira does not appear to have been motivated by whistleblower outrage over perceived injustices.
Instead, the young Airman First Class appears to have simply been trying to impress the other young men and teens in the Discord chatroom he ran.
Teixeira made his initial appearance before a federal judge in Boston on Friday to face charges he unlawfully removed and retained classified materials.
FBI agents arrest Jack Teixeira, an employee of the U.S. Air Force National Guard, outside his home in North Dighton, Massachusetts, on Thursday
One person who went to school with Teixeira (pictured) recalled that he would sometimes carry a textbook on military vehicles featuring tanks, planes and submarines
Airman Teixeira is enlisted in the 102nd Intelligence Wing of the Massachusetts Air National Guard at Otis Air National Guard Base
Teixeira only spoke twice during the brief proceeding, answering ‘yes’ when asked if he understood his right to remain silent, according to Reuters.
Teixeira is charged with unlawfully copying and possessing classified defense records. Each offense can carry up to 10 years in prison.
He is also charged with another offense which makes it a crime for an employee of the United States to knowingly remove classified records to an unauthorized location.
In a sworn statement, an FBI agent said that Teixeira had held a top secret security clearance since 2021, and that he also maintained sensitive compartmented access to other highly classified programs.
Since May 2022, the FBI said Teixeira has been serving as an E-3/airman first class in the US Air Force National Guard and has been stationed at Otis Air National Guard Base in Massachusetts.