The FBI and the Department of Defense are scrambling to uncover how it was that two highly classified intelligence documents related to Israel’s preparation for a potential retaliatory attack on Iran appeared on a Middle East news-related Telegram channel days ago.

The White House has described President Biden as “deeply concerned” over the serious breach, and has confirmed there is an intense investigation ongoing to ascertain how it happened and who had access.

At this point it’s not even confirmed whether the documents were made public via a hack or a leak by an individual who had access to them.

The documents were produced by the US National Geospatial-Intelligence Agency and National Security Agency, and were marked “Top Secret” and restricted from distribution from most foreign allies, with the exception of countries belonging to the “Five Eyes”.

The White House also said Monday that at this point officials do not believe that more documents were breached beyond the two which were made public.

CNN meanwhile reports that investigators currently believe the intel docs were leaked by someone within the US intelligence community:

The FBI is leading the investigation, working with Pentagon investigators and the intelligence community, according to US officials briefed on the matter.

In recent days, investigators have worked to authenticate the documents and determine who could have had access to them, the officials said.

That focus is one indication that, for now, the FBI and other investigators are working off the theory that the breach most likely came from a government insider and not from a cyber intrusion.

Statements attributed to the FBI further suggest authorities are getting close to tracking down the culprit. While both documents were available among a relatively large pool of US intelligence analysts and officials, CNN has noted that one of them appears to have been scanned from a printed briefing book.

“That could provide investigators with a critical jumping-off point: The Defense Department, like other federal agencies, tracks when employees print classified documents. The pool of people who printed these pages would be relatively small, these sources said,” CNN details.

Another statement by the Telegram channel rejects claims made by Axios and Jerusalem Post that the group is “Iran-affiliated”. And more info on how the leak originated: pic.twitter.com/EJdiLBGyx7

— Drop Site (@DropSiteNews) October 20, 2024

This is precisely how US Air Force veteran and former NSA translator Reality Winner got caught. She printed a single classified document from her work computer, and then anonymously mailed it to The Intercept. It was an NSA document related to alleged ‘Russian interference’ in the 2016 United States elections, which involved some phishing scams and efforts at breaching voting software. The document itself was relatively vague. Government investigators were able to very quickly determine which printer was used, and which NSA employee viewed it.