2022–2023 Pentagon Document Leaks

Jack Teixeira, an airman first class of the Massachusetts Air National Guard, had allegedly photographed printouts of the documents at his parents' home in Dighton, Massachusetts, and posted them to the instant messaging platform Discord on a server named "Thug Shaker Central". The earliest posts dated to October 2022.

The documents are primarily related to the Russo-Ukrainian War, but also include foreign intelligence assessments concerning nations including North Korea, China, Iran, and the United Arab Emirates. A subset of documents was shared to Discord servers for a YouTuber and the sandbox video game Minecraft in late February and early March 2023. In April, a 4chan user posted several documents on the website's political imageboard /pol/. The documents were then spread throughout pro-Russian Telegram channels; at least one image was altered to show more Ukrainian casualties than Russian casualties.

The leaked documents contain operational briefs from the Joint Staff. Regarding the Russo-Ukrainian War, the documents suggest difficulties for both Russians and Ukrainians, in equal part; while one slide suggests that more Russians have died in the war than Ukrainians, several documents covering the Battle of Bakhmut suggest difficulties for Ukrainians in countering Russian flanking maneuvers and supply shortages in the area. Additionally, relations between Russia and other nations are covered, with multiple documents detailing efforts by Russian military intelligence agency GRU and paramilitary organization Wagner Group in promoting Russian ideals while downplaying American values. Other documents reveal attempts by Wagner Group to acquire weapons in Turkey, a NATO member. One set of documents alleges that Mossad encouraged staff and citizens to participate in judicial reform protests.

The leak spurred a diplomatic crisis between the United States and the Five Eyes. An interagency effort—composed of the Department of Defense, the White House, the Department of State, and the U.S. intelligence community—are assessing the leak. Concurrently, the Department of Justice and Federal Bureau of Investigation have opened a criminal inquiry into the leaker. U.S. officials have accused Russia of being behind the leak. Ukraine and Russia have downplayed the leak, with both countries saying that the documents contain distorted figures. Specific claims in the leaks have been denied by some countries, such as by South Korea and Egypt. On April 13, 2023, the FBI arrested Teixeira in connection with the leak.

In October 2021, the United States became aware of efforts by Russian president Vladimir Putin to quickly increase military spending in Russia by diverting funds from the country's response to the COVID-19 pandemic. Using satellite imagery, intercepted communications, and sources within Russia, the U.S. believed that Putin intended to invade Ukraine. Speaking to President Joe Biden, the chairman of the Joint Chiefs of Staff Mark Milley stated Russia would attempt a multidirectional shock and awe attack. Since the Russian invasion of Ukraine began in February 2022, the U.S. has provided the Ukrainian government with intelligence on Russia. Representative Adam Smith, the then-chair of the House Armed Services Committee, said that the U.S. provides "some intelligence" to Ukraine on MSNBC's Morning Joe, but reserved that the U.S. was not providing the "kind of real-time targeting" that the U.S. has provided in other conflicts. White House press secretary Jen Psaki commented that the U.S. provided more significant intelligence than what Smith described. Responding to Politico, a spokesperson for Smith called the United States' intelligence "rapid".

The documents are believed to have been first posted in early March 2023 to a large audience in a Discord server for British-Filipino YouTuber wow_mao. They gained wider attention after they were posted two days later on a Minecraft server, in a discussion in which one user cited them in an argument with another.

A Bellingcat investigation found that the documents had been posted in a Discord server for the YouTuber Oxide. Several sources interviewed by Bellingcat stated that the documents were posted as far back as October 2022, and were posted by a server administrator known as "OG" in a channel about the Russian invasion of Ukraine. Speaking to The Washington Post, Oxide—who currently serves in the United States Army in the Pacific Northwest—told the publication that he had banned various users in his own Discord server a year prior, including some for posting a meme video of a black man in a gay porn film, dubbed the "thug shaker". The banned users then moved to the Thug Shaker Central server.

According to The Washington Post, OG regularly brought home documents from an unnamed military base. Users of the server formed a bond with OG as he posted the documents, believing him to be a trusted source, with some knowing his full name and state. An investigation by The New York Times, following a digital evidence trail, found that OG is likely Jack Teixeira (born 2001), an airman in the 102nd Intelligence Wing of the Massachusetts Air National Guard. According to The New York Times, details on the margins of the document photographs match those in Teixeira's childhood home. Teixeira was promoted to airman first class in July 2022, and became a cyber transport systems journeyman stationed at Otis Air National Guard Base on Cape Cod. On other social media platforms, Teixeira was also known as jackthedripper. According to the court documents, a social media user suspected of being Teixeira began releasing classified information on an unspecified social media platform in the form of "paragraphs of text" as early as December 2022.

On April 5, an anonymous user on the /pol/ imageboard on 4chan posted several images of the documents, with that user's documents circulating via pro-Russian Telegram channels. One such channel, "Donbass Devushka", republished these images. The images posted to Donbass Devushka and to /pol/ are identical, except for one image, where the number of Ukrainian casualties outweighs Russian ones, suggesting that the image was altered, possibly by Donbass Devushka. The Wall Street Journal reported that Sarah Bils, a former aviation electronics technician 2nd Class, last stationed at Naval Air Station Whidbey Island, is allegedly behind the Donbass Devushka social media accounts that posted at least four of the classified documents. Malcontent News reported that an anti-Russian-misinformation open source intelligence movement, North Atlantic Fella Organization, identified Bils as one of the personas behind Donbass Devushka.

The New York Times initially reported on the documents two days after they were posted on Telegram. The documents continued to be spread on Twitter. In response to a tweet about the leak, Twitter CEO Elon Musk alluded to the Streisand effect, and suggested that Twitter would not take down the documents. Discord is "cooperating with law enforcement" in regard to the leak. On April 21, The New York Times reported that a user whose profile matched Teixeira had shared the documents to another Discord server beginning on February 25, 2022, days after the Russian invasion of Ukraine began. 64 photographs of the leaked documents were published by Distributed Denial of Secrets.

The documents—primarily in the form of pictures of charts and graphs—concern intelligence that the United States holds on other nations, including North Korea, China, and Iran, and the Russian invasion of Ukraine. The number of documents is estimated to be over 100 pages. The documents appeared online as photographs of documents atop an apparent hunting magazine, with other objects such as zip lock bags and Gorilla Glue scattered throughout the photographs. Senior U.S. officials have attested to their legitimacy, believing that the documents are intelligence and operational briefs from the Joint Staff within the Pentagon. The documents appear to be compiled from multiple sources, including the National Security Agency (NSA), the Bureau of Intelligence and Research (INR) of the State Department, and the Central Intelligence Agency (CIA); in the lattermost case, one section of the documents originates from a daily intelligence update.

In releasing the documents, the documents were first photographed and then uploaded online. According to Javed Ali, a former U.S. counter-terrorism official, the uploader of the documents may have taken steps to conceal their IP address and timestamps from the photographs in an effort to feign anonymity. The classified material would have been limited to a sensitive compartmented information facility (SCIF), where electronic devices connected to the Internet are prohibited. A senior U.S. official stated that hundreds—potentially thousands—of government officials may have obtained the documents.

Russo-Ukrainian War

Battle of Bakhmut

One document dated late February 2023 detailed Russian flanking maneuvers near Bakhmut, discussions by the Ukrainian military about how to respond, and supply shortages in the area. An intelligence assessment states that as of February 25, Ukrainian forces in Bakhmut were nearly encircled; a senior Ukrainian official noted that morale was low among Ukrainian soldiers. Kyrylo Budanov, Ukraine's director of military intelligence, described the Ukrainian position as "catastrophic", and offered to deploy elite units to safeguard the single supply line and prevent encirclement. Deployment of reinforcements, including elite units, ultimately prevented the encirclement, but at a strategic cost, depleting seasoned forces that may have been in reserve for the spring counter-offensive.

Casualty estimates

The documents also cover information on U.S.-provided military resources Ukraine has access to, purported Pentagon estimates on Russian and Ukrainian casualties, and alleged information on Ukraine's planned counteroffensive. Several documents also offer "low confidence" estimates for the number of casualties, with the U.S. estimating 189,500 to 223,000 Russian casualties, compared to 124,500 to 131,000 Ukrainian casualties. One document also states that the number of soldiers killed in action in the Armed Forces of Ukraine is between 15,500 and 17,500, while those of the Russian Armed Forces is between 35,500 and 43,000.

The documents also allege that the Spetsnaz GRU has suffered significant casualties as a result of the unit's use in the war.

Russian military planning

 

In one top secret document, plans by the Russian General Staff to counter NATO-provided tanks were detailed. One such plan involves paying Russian soldiers who destroy NATO tanks. The documents also show U.S. awareness of Russian military planning, such as plans to destroy a hangar containing drones near Odesa.

Russia–NATO aircraft encounters and near shootdown

According to one document, a Russian fighter jet nearly shot down a British surveillance plane off of the coast of Crimea. The incident, referred to as a "near-shootdown" of a Rivet Joint—a moniker referring to a variant of Boeing RC-135s—from the United Kingdom, occurred in September 2022. The incident was disclosed in October by Ben Wallace, the Secretary of State for Defence, to the House of Commons. Wallace specifically named two Sukhoi Su-27 jets as flying "recklessly", with one of the jets firing a missile at the Rivet Joint; Wallace believed the firing was a technical issue. Under the North Atlantic Treaty, such an attack could have provoked a larger response from NATO as a whole had the missile hit the plane. The document, labeled as classified for non-U.S. citizens, was among others detailing encounters that Russian fighter jets had with foreign aircraft, including the 2023 Black Sea drone incident. According to the document, French and British aircraft flew crewed reconnaissance flights between the near-shootdown and February 26, 2023. Two U.S. defense officials later stated that the pilot of the Russian fighter jet misunderstood commands from a radar operator.

Weapons use by Ukraine

The documents suggest that Ukraine's air defense against aircraft—largely made up of the S-300 and Buk missile systems—will be depleted by May. Several documents refer to Ukraine using weapons within Russia. According to one document, in late February, Ukrainian president Volodymyr Zelenskyy suggested the use of unmanned aerial vehicles (UAVs) to strike within the Rostov Oblast. Another document states that China could increase aid to Russia if Ukraine struck within Russia. The documents also exposed LAPIS, an advanced satellite system used by the Ukrainian military.

Documents also outline a proposed "Combat Power Build" consisting of 9 planned brigades supplied by the United States and allied partners.

Weapons use by Russia

One document detail how Russia has attempted to disrupt Starlink systems provided by SpaceX to Ukraine.

Western special forces

The documents included the list of countries which have small contingents of military special forces operating inside Ukraine; the United Kingdom sent the largest number of soldiers at 50, followed by Latvia (17), France (15), the United States (14) and the Netherlands (one). The United States special forces were detailed to the U.S. embassy in Kyiv to provide security for VIPs and to assist with oversight of U.S. equipment and supplies being sent to Ukraine.

Countries

Russia

A document details efforts by the GRU, Russia's military intelligence agency, to engage in information warfare in Africa that promoted "Russian foreign policy" while downplaying public opinion about the United States. The Russian paramilitary organization Wagner Group is also mentioned. One document states that Wagner Group emissaries met with authorities from Turkey in February, suggesting that Wagner Group could obtain the weapons from an outpost in Mali. The intelligence findings suggest that Wagner chief's Yevgeny Prigozhin's claims that the Russian Defense Ministry has been skimping on ammunition supplies to Wagner may have been grounded in fact. Another document provides an estimate of the number of Wagner personnel in Mali, noting that the large Wagner presence has raised security concerns in neighboring Ivory Coast.

A Defense Intelligence Agency analysis discovered in the leak found that peace talks between the U.S. and Russia are unlikely, even if Ukraine is able to mount "unsustainable losses on Russian forces". Previous documents show that U.S. intelligence does not believe Ukraine can yield significant gains with their counteroffensive.

A document prepared by the US Joint Chiefs of Staff, Cyber Command, and European Command analysed Russian online disinformation and propaganda operations of Fabrika – a Russian disinformation network under direct purview of the Russian presidential administration – as of late 2022, finding that their operations are becoming more effective, with 99% of their fake social media accounts evading detection by platforms (though experts have questioned the significance of this finding after the document was made public, noting that the impact of fake accounts may nonetheless be negligible if not picked up by other users). Fabrika uses bots to manipulate search results and recommendations algorithms, as well as actively targeting individuals with propaganda directly with email and phone contact information collected from databases. Fabrika is attempting to demoralise Ukrainians and deepen rifts in Western countries.

China

Analysis of risks posed by China are mentioned throughout the documents. Documents speak to inadequacies of Taiwan's air defenses, U.S. intelligence assesses China would probably establish air superiority very rapidly in an attack on Taiwan. One document overviews a test of the DF-27 (Dongfeng) ballistic missile, which possess a "high probability" of penetrating U.S. ballistic missile defense systems. An assessment by U.S. intelligence community notes that China is likely developing cyber-attack capabilities to "deny, exploit and hijack" Western satellites. A section of the documents details a potential deployment of British naval aircraft carriers in the Indo-Pacific and differing visions of Indo-Pacific (Counter-PRC) policies between the Conservative and Labour parties. Other information in the documents leak include Chinese investments in a Nicaraguan deep-sea port, Chinese complaints regarding the exclusion of Huawei in Jordanian 5G bidding, a satellite rocket launch in March, the commissioning of a new Yushen-class landing helicopter dock, Chinese Hikvision surveillance equipment in DoD supply chains and instructions for Chinese foreign affairs officials regarding the high-altitude balloon incident. One National Geospatial-Intelligence Agency document shows satellite imagery of two WZ-8s that could provide China an advantage in a potential war against Taiwan.

Egypt

 

One document overviews conversation between Abdel Fattah el-Sisi, the president of Egypt, and senior Egyptian military officials, over the production and shipment of some 40,000 rockets, and references plans by Egypt to sell artillery and gunpowder to Russia. Sisi attempted to keep the supply a secret to "avoid problems with 'the West'". Workers were told that the rockets were for the Egyptian Army. The document references a person known only as Salah al-Din, believed to be Mohamed Salah al-Din, the minister of state for military production. Salah al-Din reportedly told Sisi that he would "order his people to work shift work if necessary" to repay Russia for unknown help. In addition, Sisi considered selling "ordinary stuff" to China to produce more Sakr-45 rocket launchers. Egyptian officials rejected the allegation of rocket exports to Russia; separately, Russian officials also called it a hoax.

Iran

The documents suggest that the U.S. has been able to surveil Iran. In one document, senior Iranian leaders are described discussing an upcoming visit by Rafael Grossi of the International Atomic Energy Agency (IAEA), and how to alter domestic news coverage. The document also suggests the U.S. has been able to monitor the IAEA.

Pakistan

In a memo titled "Pakistan's Difficult Choices", Pakistani Minister Hina Rabbani Khar argued that Pakistan can "no longer try to maintain a middle ground between China and the United States." It warned that the instinct to preserve Pakistan's partnership with the United States would ultimately sacrifice the full benefits of the country's "real strategic" partnership with China.

Serbia

The documents state that Serbia supplied weapons to Ukraine for its defense against Russia, or had agreed to do so, despite Serbia refusing to sanction Russia economically.

South Korea

The documents outline internal debates in South Korea regarding a request by the U.S. to provide Korean artillery shells to Ukraine, about whether it would violate South Korea's policy on lethal aid if the U.S. then sent them to Ukraine. These debates were obtained through signals intelligence conducted by the CIA. One official suggested the possibility of selling artillery shells to Poland instead, where it would then be sent to Ukraine. South Korea's President Yoon Suk-yeol described the leaked documents as "utterly false ... compromising national interest". The South Korean government announced that in a phone call between U.S. Secretary of Defense Lloyd Austin and his counterpart in South Korea, both countries agreed that large portions of the South Korea-related documents were fabricated.

Israel

The documents show how the U.S. sought to pressure Israel into providing lethal aid. Israel has previously denied Ukraine weaponry, including its Iron Dome air defense system. Out of four options pressed by the U.S., Israel was most likely to engage in the "Turkish model", providing weaponry to Ukraine through third parties while remaining cordial with Russia.

One set of documents states that the Mossad—the national intelligence agency of Israel—encouraged staff and citizens to participate in judicial reform protests that flared up in January, following a series of changes supported by Prime Minister Benjamin Netanyahu. According to the documents, director David Barnea supported junior employees participating in the protests under the guise of anonymity. The Israeli government issued a statement denying the claims, and Israeli political commentators noted that the document appears to confuse permission with encouragement, and the actions of current and former Mossad employees.

Taiwan

Intelligence assessment documents question Taiwan's ability to withstand a potential PRC invasion, noting that PRC would swiftly establish air superiority in a potential conflict, and that it would likely to be far more effective in establishing air superiority in comparison to Russia's push for air superiority during its 2022 invasion of Ukraine. The assessments furthermore note that only half of Taiwan's aircraft would be combat ready, that the Taiwanese military leadership questions the effectiveness of its anti-missile air defences, and that Taiwan would be slow to move its airforce fleet to shelters, leaving it exposed to destruction by missile strikes. The documents further note that PRC use of civilian ships for military purposes is making it difficult for US intelligence to predict a potential PRC invasion of Taiwan.

Turkey

According to Reuters, Wagner personnel intended to purchase weapons and equipment from Turkey to use them in Mali and Ukraine. Leaked documents also say that the President of Mali Assimi Goïta confirmed that Mali could acquire weapons from Turkey on Wagner's behalf.

Canada

Several documents allege that Russian cybercriminal group Zarya, acting under the direction of the Federal Security Service, compromised the IP address of an unnamed Canadian gas company and were capable of increasing valve pressure, disabling alarms, and shutting down pipelines.

Haiti

The documents state that the Wagner Group is seeking to expand its operations into Haiti, offering to combat violent gangs on behalf of the Haitian government.

United Arab Emirates

The documents include information about American military ally United Arab Emirates' (UAE) ties with Russia, and the proposed creation of a regional weapons repair facility in the UAE for Abu Dhabi's inventory of Russian weapons. Russian weaponry operated by the UAE, includes Pantsir air defense systems, Kornet portable anti-tank missiles, Igla portable surface-to-air missiles and BMP-3 infantry fighting vehicles.

Leaked Russian intelligence surveilled by the U.S. indicated that Russian spies were boasting about an alleged intelligence alliance between Moscow and Abu Dhabi against the U.S. and U.K. This claim, supported only from the Russian side, was denied by Abu Dhabi as "categorically false".

Organizations

Gulf Cartel

Following the 2023 Matamoros kidnappings, U.S. intelligence agencies began increasing their surveillance of the Gulf Cartel.

U.S. espionage targets

According to the leaked documents, U.S. intelligence spied on U.N. Secretary-General António Guterres because it believed Guterres was too soft on Russia. The leaks also revealed other U.S. espionage activities – including against allies such as Jordan's Ministry of Foreign Affairs, Turkey, Ivory Coast and Colombia. One document states that the U.S. has been spying on Zelenskyy.

While the common practice of reciprocal spying among allied states is known among and countenanced by government officials, public revelations of such activities nonetheless present a political and diplomatic nuisance for governments involved.

Sources and methods

In addition to the intelligence findings themselves, the leaked documents also reveal the sources and methods of intelligence gathering, for example revealing that the CIA is using signals intelligence to spy on discussions inside the Russian Defense Ministry, as well as to eavesdrop on the South Korean and Israeli governments, and individuals associated with the Wagner Group. The leak further reveals which Russian agencies have been penetrated by U.S. intelligence. The leak imperils future intelligence gathering efforts as targets take countermeasures and patch up exposed vulnerabilities, and puts human sources at risk.

The Department of Defense are assessing the leak, along with the White House, the State Department, and other intelligence agencies. The Department of Justice and Federal Bureau of Investigation (FBI) has opened a criminal inquiry into the leaker. According to Brandon Van Grack, who led the Department of Justice investigation into Edward Snowden, the Department of Justice and FBI are reviewing who may have posted the documents. Van Grack also stated that the investigation into the leak may impair the FBI investigation into Donald Trump's handling of government documents and the special counsel investigation into classified documents discovered at the Penn Biden Center and Biden's home.

On April 13, 2023, the FBI searched the home of Jack Teixeira's mother. An arrest was made shortly thereafter in North Dighton, Massachusetts. According to an affidavit, Discord gave the FBI Teixeira's home address through billing information he provided. The United States Air Force announced a separate investigation on April 18 and removed the 102nd Intelligence Wing from its intelligence assignments.

United States

 

The documents leak began a diplomatic crisis between the U.S. and the Five Eyes, with officials in the United Kingdom, Belgium, Germany, the United Arab Emirates, and Ukraine questioning the U.S. as to how the documents surfaced online. U.S. officials told allies that the Biden administration was investigating the leak. Wendy Sherman, the Deputy Secretary of State, has been tapped to lead the diplomatic response to the leak. U.S. Secretary of Defense Lloyd Austin stated that "We will continue to investigate and turn over every rock until we find the source of this and the extent of it."

On the night of Teixeira's arrest, Fox News host Tucker Carlson falsely told viewers that the disclosure of fourteen American special forces members in Ukraine showed that the U.S. is "a direct combatant in a war against Russia. As we speak, American soldiers are fighting Russian soldiers." Republican House member Marjorie Taylor Greene tweeted that Teixeira "told the truth about troops being on the ground in Ukraine." The special forces were not engaged in combat but rather detailed to the U.S. embassy in Kyiv to provide security for VIPs and to assist with oversight of U.S. equipment and supplies being sent to Ukraine. Greene's response was criticized by Republican senator Lindsey Graham.

According to a senior U.S. official, the Biden administration is looking into expanding its monitoring of social media sites as a result of the leak. According to Emma Best, the Department of Defense asked Distributed Denial of Secrets to remove the Pentagon document leaks, but DDoSecrets "basically just ignored them".

Ukraine

Ukrainian presidential advisor and peace negotiator Mykhailo Podolyak said that the leak contained a "very large amount of fictitious information" which appeared to be "standard elements of operational games by Russian intelligence and nothing more." Ukrainian defense intelligence spokesman Andriy Yusov said "in recent decades, the Russian special services' most successful operations have been taking place in Photoshop... we see false, distorted figures on losses on both sides, with part of the information collected from open sources." On the same day Ukraine President Volodymyr Zelenskyy released a statement about a meeting with military staff in part "focused on measures to prevent the leakage of information."

Quoted by The New York Times, Ukrainian Lieutenant Colonel Yuriy Bereza said, "We can no longer determine where is the truth and where is the lie ... We are at that stage of the war when the information war is sometimes even more important than the direct physical clashes at the front."

Russia

Russian military analyst Yuri Kotenok claimed the slides might have been planted by the U.S. to mislead Russia and downplay the strength and readiness of Ukrainian brigades before an offensive. Kyle Walter of British firm Logically, which researches disinformation, says most voices on Russian-speaking Telegram were calling the leak a Western false flag. Conversely, Kremlin spokesperson Dmitry Peskov said that the leaks were "quite interesting", though also denied specific claims in the leak such as alleged proposal for Egyptian rocket exportation to Russia.

South Korea

 

South Korean president Yoon Suk-yeol defended the country's relationship with U.S. and downplayed the leak, while opposition lawmakers from the Democratic Party of Korea expressed disdain. Lee Jae-myung, the leader of the Democratic Party, said that the leaks "[undermine] the South Korea-U.S. alliance". Kim Tae-hyo, a deputy national security advisor to Yoon, denied the veracity of conversations detailed in the documents.

A researcher of information operations, Thomas Rid, said "The fact that unedited and edited – doctored – versions of some files are available online makes me skeptical that this is a professional Russian intelligence operation", because the falsification of casualties and other details "only makes it easier to detect the facts, and thus defeats the purpose." According to Rid and CNN, if the details were both stolen by Russia and useful to Russia, they would not have publicized both the doctored and original versions, since it would weaken their impact.

The documents leak has been compared to the 2010–2011 United States diplomatic cables leak and the 2013 global surveillance disclosures. In comparison to these leaks, the documents leak contains relatively recent information on the Russian invasion of Ukraine that could be used against Ukraine, presenting a far more drastic leak.

• Pentagon Papers – U.S. defense report on 1945–1967 U.S. involvement in Vietnam
• Vulkan files leak – Leaks implicating Russian company NTC Vulkan