Leaked US documents on Ukraine could have been posted in winter – Bellingcat

Bellingcat investigators have found that the sensitive US documents focusing on the war in Ukraine, whose leak has recently been widely publicised, were posted on a WowMao Discord server as early as 1 and 2 March, though they might have first been leaked even earlier.

Source: Bellingcat

Details: Bellingcat investigators have traced the leaked documents’ journey through the internet.

The New York Times first reported the leak on 5 April, after a number of Russian Telegram channels shared photographs of five documents relating to the invasion of Ukraine. Bellingcat found that at least one of the images was heavily edited.

Those documents were dated early March, around the same time they were first posted on Discord, a social media platform popular with gamers.

Bellingcat found evidence that some of the documents, dated January 2023, might have been posted online even earlier, though it is unclear when exactly. Bellingcat spoke with three members of the Discord group where the images were posted, who claimed that a lot more documents have been posted to other – now deleted – Discord servers over the course of the past several months.

The Discord servers where the documents dated March 2023 were posted were dedicated to Minecraft, a popular video game, and the fans of a Filipino YouTube star. The documents were later shared on other websites, such as the 4Chan imageboard, and later Telegram, Twitter and some of the largest global media.

None of the documents seen by the Bellingcat investigators were scanned; they appeared to have been photographed instead. The investigators noted that at least some of the documents were photographed in the same location.

On 5 April, the documents were first shared on pro-Russian Telegram channels. Bellingcat  traced the first version to the Donbass Devushka Telegram channel, where some of the documents were posted at 21:29 Kyiv time. The post contained four images; later, another image was shared in another post.

Several hours prior to that, a 4chan user posted first out of a total of eight messages on the Politically Incorrect (/pol/) thread; three of these posts had images of several documents attached. The documents appeared similar at first, but were in fact quite different.

Only one image was the same across the 4chan and Telegram posts: a map capturing a number of statistics, including the number of Russian and Ukrainian losses since the beginning of the war. The numbers were different in the two sources: the number of Russian losses exceeded that of Ukrainian losses in the document posted on 4chan, but the document posted on the Donbass Devushka Telegram channel showed Ukrainian losses exceeding the Russian ones. Bellingcat investigators found that this second image appears to have been edited.

On 4 March, more than a month before the Telegram and 4chan posts, a user attached 10 documents about Ukraine, some of which were classified as Top Secret, to a message on a Discord server called Minecraft Earth Map. All seven of the documents from the 4chan and Telegram posts, including the map with the lower Ukrainian casualty figures, were present in this post, as well as three other documents that had not been posted in any of the Telegram, Twitter or 4chan posts at the time.

The user who shared these documents later claimed on Twitter that he found them on a Discord server called WowMao.

On 1 and 2 March, the WowMao user posted more than 30 documents on the server, many of which were classified as Top Secret, which preceded the posting on the Minecraft server. The same user also posted dozens of other documents about Ukraine on the server before they were removed on 7 April.

However, the WowMao server may still not be the original source of these documents, the investigators write.

Bellingcat spoke to members of a separate Discord community who claimed that other images were posted earlier on another, currently deleted server, often referred to as Thug Shaker Central but which also went by several other names at different times. The image files shown to Bellingcat contained a detailed description of another document in the same style and format as those posted on the WowMao server, which was dated 13 January. The content of these documents was blurred, except for the date and classification.

The Thug Shaker Central server was originally named after its founder, one of the server's members, who goes by the nickname Vakhi, told Bellingcat. The server's admin duties were then passed from one user to another before a new member took over and the server went through one of many name changes. Vakhi did not want to name this person, but said he was the original source of the leaked documents. According to Vakhi and two other users who spoke to Bellingcat but declined to be identified, the files that were leaked to WowMao are just "the tip of the iceberg" compared to the number of documents hosted on Thug Shaker Central.

There is no trace of this server other than the testimonies of these users and scattered mentions of its existence on 4chan. Therefore, Bellingcat is unable to independently verify all the information shared by these users, including the aforementioned January document, and whether the person described as the source of the leak was indeed the original source.

Background:

• On 6 April, The New York Times reported that classified military documents detailing US and NATO plans to build up the Ukrainian army ahead of a planned counteroffensive had been leaked on Twitter and Telegram.
• Mykhailo Podoliak, an adviser to the head of the Office of the President of Ukraine, called the leaked materials "photoshopped" and joked about the deterioration in Russian intelligence. US officials told Reuters on condition of anonymity that Russia or pro-Russian elements were behind the leak of several classified US military documents posted on social media that allegedly showed preparations for Ukraine’s spring counteroffensive.
• Later, a new batch of classified documents appeared on social media, allegedly detailing US national security secrets regarding Ukraine, the Middle East, and China.
• On 9 April, the US Department of Justice launched an investigation into the leak of a huge number of US intelligence documents that have been posted on social media in recent weeks.

Journalists fight on their own frontline. Support Ukrainska Pravda or become our patron!