New Leak of Classified Documents on Social Media Alarms Pentagon

WASHINGTON — A new batch of classified documents that appear to detail American national security secrets from Ukraine to the Middle East to China surfaced on social media sites on Friday, alarming the Pentagon and adding turmoil to a situation that seemed to have caught the Biden administration off guard.

The scale of the leak — analysts say more than 100 documents may have been obtained — along with the sensitivity of the documents themselves, could be hugely damaging, U.S. officials said. A senior intelligence official called the leak “a nightmare for the Five Eyes,” in a reference to the United States, Britain, Australia, New Zealand and Canada, the so-called Five Eyes nations that broadly share intelligence.

The latest documents were found on Twitter and other sites on Friday, a day after senior Biden administration officials said they were investigating a potential leak of classified Ukrainian war plans, include an alarming assessment of Ukraine’s faltering air defense capabilities. One slide, dated Feb. 23, is labeled “Secret/NoForn,” meaning it was not meant to be shared with foreign countries.

The Justice Department said it had opened an investigation into the leaks and was in communication with the Defense Department but declined to comment further.

Mick Mulroy, a former senior Pentagon official, said the leak of the classified documents represents “a significant breach in security” that could hinder Ukrainian military planning. “As many of these were pictures of documents, it appears that it was a deliberate leak done by someone that wished to damage the Ukraine, U.S., and NATO efforts,” he said.

One analyst described what has emerged so far as the “tip of the iceberg.”

Early Friday, senior national security officials dealing with the initial leak, which was first reported by The New York Times, said a new worry had arisen: Was that information the only intelligence that was leaked?

By Friday afternoon, they had their answer. Even as officials at the Pentagon and national security agencies were investigating the source of documents that had appeared on Twitter and on Telegram, another surfaced on 4chan, an anonymous, fringe message board. The 4chan document is a map that purports to show the status of the war in the eastern Ukrainian city of Bakhmut, the scene of a fierce, monthslong battle.

But the leaked documents appear to go well beyond highly classified material on Ukraine war plans. Security analysts who have reviewed the documents tumbling onto social media sites say the increasing trove also includes sensitive briefing slides on China, the Indo-Pacific military theater, the Middle East and terrorism.

The Pentagon said in a statement on Thursday that the Defense Department was looking into the matter. On Friday, as the disclosures widened, department officials said they had nothing to add. But privately, officials in several national security agencies acknowledged both a rush to find the source of the leaks and a potential for what one official said could be a steady drip of classified information posted on sites.

The documents on Ukraine’s military appear as photographs of charts of anticipated weapons deliveries, troop and battalion strengths, and other plans. Pentagon officials acknowledge that they are legitimate Defense Department documents, but the copies appear to have been altered in certain parts from their original format. The modified versions, for example, overstate American estimates of Ukrainian war dead and underestimate estimates of Russian troops killed.

On Friday, Ukrainian officials and pro-war Russian bloggers suggested the leak was part of a disinformation effort by the other side, timed to influence Ukraine’s possible spring offensive to reclaim territory in the east and the south of the country.

A senior Ukrainian official said that the leak appeared to be a Russian ploy to discredit a counteroffensive. And the Russian bloggers warned against trusting any of the information, which one blogger said could be the work of “Western intelligence in order to mislead our command.”

Behind closed doors, chagrined national security officials were trying to find the culprit. One official said it was likely that the documents did not come from Ukrainian officials, because they did not have access to the specific plans, which bear the imprint of the offices of the Pentagon’s Joint Staff. A second official said that determining how the documents were leaked would start with identifying which officials had access to them.

The first tranche of documents appeared to have been posted in early March on Discord, a social media chat platform popular with video gamers, according to Aric Toler, an analyst at Bellingcat, the Dutch investigative site.

In Ukraine, Lt. Col. Yurii Bereza, a battalion commander with Ukraine’s National Guard whose forces have fought in the country’s east in recent months, shrugged off news of the leak.

He noted that information warfare had become so intense that “we can no longer determine where is the truth and where is the lie.”

“We are at that stage of the war when the information war is sometimes even more important than the direct physical clashes at the front,” Colonel Bereza said.

A soldier in his unit, Maksym, had yet to hear the news. “We have a lot of our own problems, and with this leak I have no words,” he said angrily.

Outside experts said it was difficult to draw conclusions about who released the information and why.

Kyle Walter, the head of research at Logically, a British firm that tracks disinformation, said many prominent voices on Russian Telegram channels were calling the original, apparently unaltered photo showing Russian and Ukrainian casualties a “Western influence” operation.

“They think the actual unedited photo where it shows high Russian loss numbers and relatively low Ukrainian loss numbers is an attempt to instill poor morale in Russia and Russian forces,” Mr. Walter said.

Jonathan Teubner, the chief executive of FilterLabs AI, which tracks messaging in Russia, said that while pro-Kremlin voices were saying the leak was an American or Ukrainian disinformation campaign, his lead analyst thought it could be a Russian operation meant to sow distrust between Washington and Kyiv.

The doctored photo showing lower casualty numbers for Russia, and higher ones for Ukraine, than reported figures has been discussed far more frequently in Western-oriented social media than in Russian-focused platforms, Mr. Walter said.

It has been a frequent Russian disinformation tactic to alter stolen documents, including some purportedly leaked from the Ukrainian government, Mr. Walter said. But because Ukraine’s government has dismissed these documents as altered or out of context, they generally do not gain much traction, he added.

“There are a lot of examples of leaked documents being used in propaganda campaigns and specifically in terms of disinformation,” Mr. Walter said. But what is going on with these American documents, he added, “is still pretty unclear at the moment.”

The Ukraine war, Mr. Walter said, has had more document leaks than other conflicts, in part because of the role that open-source intelligence and declassified intelligence have played in the war.

“There’s definitely been an uptick, it’s happening more often, but that’s more indicative of just the environment we’re in rather than it being the tactic specific to the Ukraine war,” Mr. Walter said.

Natalia Yermak and Glenn Thrush contributed reporting.