The materials that circulated in early March were uploaded on a Discord, an encrypted messaging app. They appear to be photos of slide deck printouts that were folded up and then smoothed out again. They have since been posted on other social media websites, including Twitter and Telegram.
It’s unclear who originally obtained the documents, who leaked them and the extent to which they’ve been altered. It’s also possible an even earlier version exists.
A senior administration official, granted anonymity to discuss a sensitive intelligence matter, said President Joe Biden’s team is “concerned” by the large document leak. “This could be a Russian disinformation operation,” the official continued, citing the manipulations to the documents. “Russia has a history of manipulating information for disinformation purposes.” The official wouldn’t detail when the administration first became aware of the leak.
There are discrepancies between the documents posted in March and those circulated this month, suggesting the earlier tranche could be the original versions — or at least closer to it.
The leak is one of the most high-profile breaches of military intelligence since the Russian invasion in 2022 and comes at a time when Ukraine is preparing to launch the spring offensive. The documents “represent a significant breach in security, which could compromise U.S. and NATO support for Ukraine,” said Mick Mulroy, a former DoD official and CIA officer.
The images that appeared online earlier this week show slides that were produced by the Joint Staff, but which have been heavily doctored to show inaccurate information, according to a second senior administration official, speaking on condition of anonymity to discuss a sensitive topic.
In reviewing the batch of documents that circulated on Discord and those that appeared in April on sites such as Telegram, Twitter and 4chan, POLITICO found that at least one section had been changed — the death tolls. The number of Ukrainian deaths is significantly higher in the later version.
However, there are irregularities in both the March and April versions. Not all of the documents are dated. One is dated as late as March 23 — about 20 days after someone posted them on Discord. Other pages are missing security markers and have sections replaced by white space.
The documents, which are at least five weeks old, are of limited value to Moscow as they show the conflict as a snapshot in time. Still, they may help Russian intelligence planners with establishing the expected burn rate for Ukrainian supplies, the second senior official said.
The Department of Defense is investigating the leak, which the New York Times first reported, the Pentagon said Thursday.
“We are aware of the reports of social media posts, and the department is reviewing the matter,” said DoD spokesperson Sabrina Singh. The Central Intelligence Agency and the Office of the Director of National Intelligence declined to comment.
The early reaction from Capitol Hill has been fierce. “I’d fire anyone who leaks without authorization when they’re identified,” said Rep. Don Bacon (R-Neb.), a close ally of Speaker Kevin McCarthy and member of the House Armed Services Committee.
“I’m troubled by the potential leak and possible disinformation related to the documents,” said Rep. Jason Crow (D-Colo.), a member of the House Intelligence Committee. “I look forward to hearing from the Department of Defense on steps they’re taking to investigate and address any wrongdoing.”
Other pages included in the March tranche include information about various countries, Jordan, Palestine and China.
Some of the Ukraine-related documents, marked “SECRET” and dated February and March, show American and NATO plans for training and arming Ukrainian forces ahead of a planned counteroffensive this spring.
One slide includes detailed plans for equipment Western countries will deliver to Ukraine this spring, such as the number of tanks and armored vehicles each nation is sending and the estimated date of arrival. It also shows the status of training programs by different NATO countries.
One document outlines what Western equipment Ukrainian brigades are receiving and when they’ll be trained. If that information is correct, it could provide useful intelligence to Moscow about new capabilities entering the battlefield this spring and summer. It is also a fascinating look into the international grab-bag of equipment the rapidly equipped Ukrainian army now fields.
The 82nd brigade, for example, looks to be an armored powerhouse. It will boast about 150 armored infantry carriers, including 90 U.S.-Stryker vehicles, 40 German-produced Marders, 24 U.S.-made M113 infantry carriers and 14 British Challenger tanks, giving the unit a powerful punch, according to the documents. The unit is currently being trained as the equipment continues to arrive.
Similarly, the 33rd brigade will have 32 Leopard tanks from Germany, Canada and Poland, alongside 90 American-made MRAP troop carriers. All the vehicles were slated to arrive for training in March and April, according to the documents.
Another slide shows the Joint Staff’s daily update of the conflict, including planned operations of U.S. forces in the surrounding area such as the aircraft carrier USS George H. W. Bush and several submarines, the locations of which are rarely, if ever, publicized.
Others, marked “TOP SECRET,” show the U.S. military’s assessment of Russian and Ukrainian troop movements in key battlegrounds, including Bakhmut, Kharkiv and the Donetsk, on March 1.
Both the March and April tranches show updates from the battlefield from February that includes an allegation that “agents” of Ukraine attacked a Russian aircraft based in Belarus. The Ukrainian government has previously denied those claims. A spokesperson for President Volodymyr Zelenskyy’s office did not respond to a request for comment on the incident.
