https://www.nytimes.com/2017/06/06/us/politics/reality-leigh-winner-leak-nsa.html?_r=0
An F.B.I. affidavit said a visible crease mark on the file, a scan of which The Intercept provided to the government while trying to authenticate it, prompted investigators to surmise it was a printout.
Audit trails showed six people had printed copies, but only one — Ms. Winner — had also used a work computer to exchange emails with The Intercept. A search warrant application said she had found the report by plugging keywords into the N.S.A.’s system that fell outside her normal work duties — and had printed no other files.
And there may have been an even more glaring telltale that the F.B.I. did not mention in court filings. Computer security experts, including the consultant Robert Graham, have noted that color printers leave barely visible microdots identifying the serial number of the printer, the date and time of the printing, 6:20 a.m. on May 9.
“The N.S.A. almost certainly has a record of who used the printer at that time,” he wrote.
Ms. Winner’s apparent Twitter feed, which used a pseudonym but had a photo of her and the same account name as her Instagram feed, makes clear her hostility toward Mr. Trump. That suggests a possible motive for leaking: highlighting Russian hacking of election-related targets
On social media — her Twitter feed went silent soon after she became an N.S.A. contractor in February — she denounced Mr. Trump as “the orange fascist we let into the white house” and mocked Attorney General Jeff Sessions as a “Confederate.” She expressed concern about climate change, and support for the Black Lives Matter movement and other liberal views.
In response to the Iranian foreign minister, she posted on Twitter a sympathetic comment: “There are many Americans protesting US govt aggression towards Iran. If our Tangerine in Chief declares war, we stand with you!”, amplifying the narrative that Mr. Trump’s victory is tainted.