Timeline in leak of secret US documents

Written by ABC Audio ALL RIGHTS RESERVED on April 12, 2023

(NEW YORK) — ABC News has reviewed 38 images that appear to depict classified U.S. intelligence documents that were among dozens apparently shared by one user of an online server on the chat website Discord on March 1 and March 2.

Discord is organized by servers; a Discord user can create their own server or can join another server. The server where the images were shared is dedicated to a YouTube creator with some 243,000 subscribers and which hosts comedic videos about philosophy, politics, and religion.

On April 7, shortly after the Discord server was publicly named in connection with the reported document leak, the area of the chat server where the images were being posted was deactivated. The server itself is still active; much of its activity now refers to the images shared there and the public interest in them.

Here is a timeline of significant developments:

February: The first of 107 images of possible documents are reportedly shared by one user of a YouTube creator’s Discord server, according to Bellingcat researcher Aric Toler.

· Feb. 24: A reference is made in the Discord server to leaked U.S. documents.

· March 1, 2: More images, including 38 reviewed by ABC News, appear in the YouTube creator’s Discord server.

· March 4: Ten of the images are re-shared in a separate Discord server devoted to the online game Minecraft

· April 5: Three images appear on 4chan; five appear in Telegram posts by a pro-Russian channel; one of those contains clear signs of manipulation to inflate Ukrainian and deflate Russian casualty figures.

· April 6: The New York Times reveals the existence of the alleged leaked documents.

· April 7: The Discord channel where possible documents were shared is publicly identified; later that day, the channel removes the images and begins to restrict access.

A review of publicly available content in the server where images of the alleged documents were posted points to pervasive racism, antisemitism and references to sexual violence. As in many niche online communities, this group appears to have a language of its own and it is difficult to discern sincere statements from ironic ones.

Each of the possible documents in the 38 images reviewed by ABC News shows creases suggesting they were folded twice. The images include detailed updates on the war in Ukraine as well as a Central Intelligence Agency briefing containing intelligence on U.S. allies, partners and adversaries.

Some images of the possible documents include visible background features such as a hunting magazine, a knife, a tube of Gorilla Glue, and a strap for the company Bushnell, which makes optics and other hunting accessories.

How the alleged documents spread

According to Toler, 107 images were shared by one user in the Discord server, some appearing in February; Toler said he has seen over 50 of them. ABC News has not independently verified the existence of more than 38 images.

After they were shared in the YouTube creator’s Discord server on March 1 and 2, 10 images of possible documents were re-shared by another user on March 4 to a separate Discord server, dedicated to the online game Minecraft.

On April 5, three images appeared in posts on 4chan; the 4chan posts were made in the context of a debate about the war in Ukraine. Five images also appeared on April 5 on a pro-Russia Telegram channel; one of those showed signs of crude manipulation to inflate Ukrainian and deflate Russian casualty figures.

Origin of the alleged documents

The original source of the possible documents or the earliest date they were shared is still unknown. An archived Twitter post from a now-deleted account, which appears to belong to the user who shared the images to the Discord server on March 1 and 2, claims that the user “found some info from a now banned server and passed it on” to the YouTuber’s Discord server.

According to another post by the same account this unidentified server had a racist, offensive name and has since been deleted.

ABC News has reviewed one post, dated Feb. 24, in the YouTuber’s Discord server, referencing the images. This suggests that at least the existence of these possible documents was known to members of this server before the large tranche of images were posted on March 1 and 2.

Toler told ABC News that “hundreds” of images were reportedly posted in a separate Discord server with a racist, offensive name before being re-shared to the YouTuber’s Discord server, something ABC News has not independently verified.