The clues that could ID classified document leaker

Snapshots of secret documents, printed time stamps, security clearances — and even glue.

These are some of the clues investigators may have examined before Massachusetts Air National Guardsman Jack Teixeira was arrested Thursday after being implicated in the leak of dozens of classified US intelligence papers.

Investigators believe the guardsman, who specialized in intelligence, led a Discord chat group where images of the documents first surfaced — before spreading like wildfire online.

US officials frantically started probing the origin of the leaks after some documents tied to the Ukraine war surfaced on Russian Telegram channels last week.

Here’s a look at what investigators could have studied as they probed the release of the sensitive docs:

Clues in the photos

Details of the interior of Teixeira’s childhood home from images on social media appear to match items identified in the background of some of the photographed documents, the New York Times reported Thursday.

An online gaming profile in Teixeira’s name featured pictures with the same kitchen countertop where copies of briefing slides were carefully unfolded and photographed.

Experts say the photos of the documents themselves would have been put under a microscope throughout the probe.

In at least two photographs reviewed by The Post, a brochure with apparent information about a rifle scope can be seen.

A photo of one of the documents also shows the file resting on a table with what appears to be a bottle of Gorilla super glue. There also appears to be a set of nail clippers in the photo, as well.

Analyzing access

There are only a few ways the leaked classified information could have been accessed, which may have provided critical clues as to who was responsible, officials said.

In classified briefings, the information is typically shared electronically — like the images that were shared on Discord, which included a slew of presentation slides and maps labeled “Secret” and “Top Secret.”

The sharing is done either through secure computer terminals which users have to access with their credentials or via devices that are distributed for briefings, then collected afterward.

Any slides that need to be printed out can only be sent to secured printers that deal with classified materials — and keep a digital record of those who have printed.

Some documents also displayed time stamps in the top right corner that showed exactly when they were printed off.

Following The Post’s latest coverage on the US intelligence leaks scandal

Attorney Mark Zaid, who specializes in national security, said this could be a key detail given the government-run classified computer systems have logs that show exactly who viewed or printed a file.

After the list of people with access is narrowed, a former federal prosecutor told Reuters, investigators could try to obtain search warrants that could potentially expose private messages and documents contained on electronic devices and cloud accounts.

Determining a motive

Throughout the probe, investigators weighed up a number of theories, including whether the leaker may have misplaced the documents or was trying to undermine national security, one US official said.

A number of the leaked documents were emblazoned with the emblems of the US Joint Chiefs of Staff and the secretary of defense, which may have helped investigators narrow down who might have been granted access to those files.

Members of the Discord chat that Teixeira was involved in insisted to the New York Times that the person who first shared the documents wasn’t a whistleblower.

Instead, they argued, he had never meant for the documents to be shared anywhere other than their online chat.

“This guy was a Christian, anti-war, just wanted to inform some of his friends about what’s going on,” one member told the outlet. “We have some people in our group who are in Ukraine. We like fighting games, we like war games.”

With Post wires