How the FBI got to Reality Winner, the alleged NSA docs leaker

How it happened:

• Feb. 13: Winner, a contractor with Pluribus International Corporation is assigned to a U.S. government agency facility in Georgia, at which point she is given top security clearance.
• May 5: An NSA report detailed that Russian military intelligence carried out a cyber attack on U.S. voting software and infrastructure in the days leading up to the November election, according The Intercept.
• May 9: Winner accessed the classified report by searching the NSA's system and printed it. She mailed the report to The Intercept a few days later. (CNN)
• May 30: The Intercept contacted the U.S. government "likely through the NSA" to verify the document's authenticity. Government officials confirmed the document was classified "at the top secret level." (ABC)
• June 1: The NSA informed the FBI of the leak, and the FBI launched its investigation. That same day, another government contractor approached the NSA, and said he was independently approached by a reporter from The Intercept to verify the documents. He told the agency that the documents had originally been mailed and were postmarked "Augusta, Georgia" — Winner's home. (WaPo)
• Early June: Authorities identified several details in the scanned copy of the report that point to Winner. Creases on the document indicated that it had been printed and transported by hand, and the NSA's internal audit revealed that six people had printed out the report. Of the six, only Winner had been in email contact with The Intercept. (Quartz)
• June 3: Winner is arrested and questioned at her home in Georgia where she admits to obtaining and leaking the document. (WaPo)
• June 5: The Intercept leaked the report, and, one hour later, the FBI announced that a suspect was in custody. (Quartz)

Critics have railed against The Intercept for exposing their source by publishing a redacted version of the leaked report. Although The Intercept never revealed Winner's identity — the company claimed in a statement Tuesday they still have "no knowledge of the identity of the person who provided us with the document" — surveillance and privacy reporter Barton Gellman tweeted that The Intercept "made egregious mistakes that doomed its source. The FBI affidavit spells them out."

• The Intercept's mistakes, as detailed by Gellman: "It handed USG a color copy of original doc & told a clearance-holding contractor the doc was mailed from Augusta. Where source lives... When reproducing online, either retype or take tech steps to strip metadata and identifying micro-images. Normal people don't know all this, but journalists should. And @theintercept does. Has world class experts in @headhntr and @micahflee. Which makes it hard to accept this catastrophic failure of source protection. Reporters & editors didn't consult experts right at hand."

• How the NSA was able to find Winner, as detailed by blogger Rob Graham: The document she gave to the Intercept contained nearly invisible yellow "tracking dots" that showed "exactly when and where documents, any document, is printed." (Errata Security Blog)
• The Intercept's defense: The Intercept released a statement on the allegations against Winner: "The U.S. government has told news organizations that Winner was that individual... While the FBI's allegations against Winner have been made public through the release of an affidavit and search warrant... it is important to keep in mind that these documents contain unproven assertions and speculation designed to serve the government's agenda and as such warrant skepticism. Winner faces allegations that have not been proven. The same is true of the FBI's claims about how it came to arrest Winner."