Who Leaked U.S. Intelligence on Israel's Secret Preparations for a Strike on Iran? And Why?The reservoir of possible leakers of U.S. intelligence documents detailing Israel's apparent preparations for a retaliatory attack on Iran is big, and the platform chosen by them – a pro-Iranian Telegram channel – is unsophisticated. But national security leaks are rarely a singular isolated event
On Thursday, two U.S. intelligence documents detailing Israel's apparent preparations for a retaliatory attack on Iran leaked on a Telegram channel called Middle East Spectator.
As is routine in such cases, the news was initially met with skepticism by the media and the disclaimer that "We cannot confirm the authenticity and veracity of these documents."
On Sunday, the Pentagon confirmed that the documents attributed to two U.S. agencies – the National Geospatial-Intelligence Agency and National Security Agency – were real. It announced its concern and that it was conducting an investigation into the leak's origins, adding that "damage to national security appears to be limited."
That's hardly reassuring, even if the damage does end up being confined to just these two documents. Surely there are more where they came from, whether on Israel-Iran, Russia-Ukraine or China-Taiwan.
As opposed to an unintentional leak, a deliberate leak of national security information is a criminal offense. Sometimes, depending on the subject matter, the circumstances, the sensitivity of the information, the methodology of how it was obtained and the intended (even if indirectly) recipient, it can constitute treason.
Such leaks are obviously a matter of access, opportunity and motivation. A leak is rarely a singular isolated event, whether it relates to national security, to politics or to corporate insider-information on securities. Every leak has several ingredients: What is the content? How was the information gathered? What is the context? What is its significance? What are the implications? Who is the leaker(s)? Was it intentional? What are the motives? Is it political dissent? Is it a warning? Was there a financial incentive? Were they extorted?
While the original term "leak" was used in reference to an inadvertent slip of the tongue by an official, or an unauthorized but essentially benign divulgence of information, modern usage applies to a whole taxonomy of leaks.
Bernard and Marvin Kalb described at length the art of the leak following their experience with U.S. Secretary of State Henry Kissinger. University of Washington scholar Richard Kielbowicz went further and wrote a book on the phenomenon: "The Role of News Leaks in Governance and the Law of Journalists' Confidentiality, 1795-2005."
Kielbowicz identified the major types of leak: those intended to influence policy; those intended to shape personal image; those intended to implicate someone else; or those intended to improve relations with the media.
Then there are leaks as a form of organizational communication: leaks as upward communication; leaks as downward communication; leaks as horizontal communication within and between governments.
This latest leak could be any of the above, or a combination. One thing seems clear: the platform chosen indicates that this was probably not a deliberate U.S. leak to pressure Israel or alert Iran. There are other, more sophisticated ways and better outlets to do that. The pro-Iranian Middle East Spectator Telegram channel describes itself as "independent, but not unbiased, striving for a multipolar world. Mainly focused on Iran & Resistance Axis" – referring to the likes of Hamas, Hezbollah and the Houthis.
The U.S. documents, based on satellite imagery from October 15-16, detail Israeli preparations for a prospective strike in response to Iran's launching of 181 ballistic missiles at Israel on October 1.
One document is titled "Israel: Air Force Continues Preparations for Strike on Iran and Conducts a Second Large-Force Employment Exercise." The second is titled ""Israel: Defense Forces Continue Key Munitions Preparations and Covert UAV Activity Almost Certainly for a Strike on Iran."
The documents' very recent date is consistent with U.S. assessments about the timing of an Israeli strike, and partially detail Israel Air Force exercises and munitions movement.
The text clarifies that "We cannot definitively predict the scale and scope of a strike on Iran, and such a strike can occur with no further GEOINT warning." GEOINT is an abbreviation of geospatial intelligence. It stresses that "MRBM [Medium Range Ballistic Missile] dispersal is almost certainly defensive" and adds that "We have not observed indications that Israel intends to use a nuclear weapon." Leak or not, that's good to know.
The visual information was compiled and analyzed by the National Geospatial Intelligence Agency, one of the U.S.' intelligence agencies providing general, planning stage and real-time operational data.
The second document is attributed to the National Security Agency, the United States' main agency working under the Director of National Intelligence. It is responsible for monitoring, collecting, and processing of information and data on foreign intelligence and counterintelligence, covering both friend and foe. The NSA's technological focus is on signals intelligence (SIGINT) and cyberwarfare capabilities.
Analytical intelligence reports – and this is what these documents are – have a wide distribution net within the U.S. intelligence community and national security apparatus, thus enlarging the reservoir of possible suspected leakers.
Furthermore, these two documents are presumably only a fraction of continuous monitoring, a snapshot of a process being watched diligently from above the planet.
On Sunday, the Pentagon confirmed the veracity of the information and that the leaked NGA documents are authentic. The leak is "deeply concerning," a U.S. Defense Department official told CNN, adding that the Pentagon and FBI have begun an investigation to identify the source. The documents were marked "top secret," but apparently also had markings indicating that they can be seen and shared among allies in Five Eyes.
Five Eyes is an Anglosphere intelligence alliance comprising the United States, United Kingdom, Australia, Canada and New Zealand. The last three countries have joined and become parties to the multilateral Anglo-American agreement – a treaty for joint cooperation in signals intelligence whose origins go back to joint efforts to break Nazi codes in World War II.
Informally, Five Eyes refers to these countries' intelligence agencies. The term pertains to the fact that no information can be shared with any other country or agency outside of the five. However, the distinctive U.S. formatting of the documents indicates that they were likely not yet disseminated to the other four allies or that the other countries were the likely source of the leak. Which leaves the U.S. government.
The Americans urged, implored and cautioned Israel not to attack Iran's nuclear installations or its oil industry infrastructure. Reportedly, Israel provided such assurances and the United States simultaneously deployed a THAAD missile battery in Israel as another layer of defense and a deterrent against Iran if it entertains the thought of further retaliation following the expected Israeli attack.
The Americans know an Israeli attack is imminent, with President Joe Biden going as far as to say on Friday that he knows when, where and what such an attack will look like. But the United States is also apprehensive about possible escalation (you can't write an article on the Middle East these days without using that term at least once).
Even if the leak was not a deliberate U.S. government attempt to influence policy, and even if the leaker – whatever their motivation – did no real harm, the two documents shed light on the level of nervousness all around.
