2022–2023 Pentagon document leaks

In April 2023, two sets of classified documents of the United States began circulating on Twitter, Telegram, and 4chan. The documents, primarily relating to the Russo-Ukrainian War, included details about foreign nations, including North Korea, China, Iran, and the United Arab Emirates. The documents began spreading on the instant messaging platform Discord, and allegedly originate from a Discord server known as "Thug Shaker Central", according to a Bellingcat investigation. A subset of documents were sent to Discord servers for a British-Filipino YouTuber and the sandbox video game Minecraft in late February and early March. In April, a 4chan user posted several documents on the website's political imageboard /pol/. The documents were then spread throughout pro-Russian Telegram channels; at least one image was altered to show more Ukrainian casualties than Russian casualties.

The documents concern intelligence that the United States has on other nations, and contain operational briefs from the Joint Staff. Regarding the Russo-Ukrainian War, the documents suggest difficulties for both Russians and Ukrainians, in equal part; while one slide suggests that more Russians have died in the war than Ukrainians, several documents covering the Battle of Bakhmut suggest difficulties for Ukrainians in countering Russian flanking maneuvers and supply shortages in the area. Additionally, relations between Russia and other nations are covered, with multiple documents detailing efforts by Russian military intelligence agency GRU and paramilitary organization Wagner Group in promoting Russian ideals while downplaying American values. Other documents reveal attempts by Wagner Group to acquire weapons in Turkey, a NATO member. One set of documents alleges that the Mossad encouraged staff and citizens to participate in judicial reform protests.

The leak has spurred a diplomatic crisis between the United States and the Five Eyes. An interagency effort—composed of the Department of Defense, the White House, the State Department, and the U.S. intelligence community—are assessing the leak. Concurrently, the Department of Justice and Federal Bureau of Investigation have opened a criminal inquiry into the leaker. U.S. officials have accused Russia of being behind the leak. Ukraine and Russia have downplayed the leak, with both countries saying that the documents contain distorted figures. Specific claims in the leaks have been denied by some countries, such as by South Korea and Egypt.

Background and initial release

In October 2021, the United States became aware of efforts by Russian president Vladimir Putin to quickly increase military spending in Russia by diverting funds from the country's response to the COVID-19 pandemic. Using satellite imagery, intercepted communications, and sources within Russia, the U.S. believed that Putin intended to seize Kyiv. Speaking to President Joe Biden, Mark Milley, the chairman of the Joint Chiefs of Staff, said that Russia would attempt a multidirectional shock and awe attack. Since the Russian invasion of Ukraine began in February 2022, the United States has provided the Ukrainian government with intelligence on Russia. Representative Adam Smith, then the chair of the House Armed Services Committee, said that the U.S. provides "some intelligence" to Ukraine on MSNBC's Morning Joe, but reserved that the U.S. was not providing the "kind of real-time targeting" that the U.S. has provided in other conflicts. Then-White House press secretary Jen Psaki commented that the U.S. provided more significant intelligence than what Smith described. Responding to Politico, a spokesperson for Smith called the United States' intelligence "rapid".

The origins of the documents are unclear, but believed to have been first posted to a large audience in a Discord server for British—Filipino YouTuber wow_mao. wow_mao, who holds an interest in geopolitics and history, took the opportunity to encourage viewers to donate to his Patreon. The documents were posted on March 1 and March 2; on March 4, a separate user posted a subset of the documents to a Minecraft Discord server. A Bellingcat investigation found that a user in a server known as "Thug Shaker Central" for may have originally posted the documents, although these claims could not be confirmed. Speaking to Bellingcat, several sources stated that the documents were posted as far back as October 2022, and were posted by a server administrator in a channel about the Russian invasion of Ukraine. A month later, an anonymous user on the /pol/ imageboard on 4chan posted several images of the documents, with the user's sequence of documents circulating throughout pro-Russian Telegram channels. One such channel, "Donbass Devushka", was attributed to the first of these images. The images posted to Donbass Devushka and to /pol/ are identical, except for one image, where the number of Ukrainian casualties outweighs Russian ones, suggesting that Donbass Devushka altered the image. The New York Times initially reported on the documents two days after they were posted on Telegram.

The documents continued to be spread on Twitter. According to a policy page, the social media platform disallows the spread of hacked materials. In response to a tweet about the leak, Twitter CEO Elon Musk sarcastically wrote that "you can totally delete things from the Internet" and "that works perfectly and doesn't draw attention to whatever you were trying to hide at all", seemingly alluding to the Streisand effect and suggesting that Twitter would not take down the documents. In contrast, Discord is "cooperating with law enforcement" in regards to the leak.

Contents

The documents—primarily in the form of pictures of charts and graphs—concern intelligence that the United States holds on other nations, including North Korea, China, and Iran, and the Russian invasion of Ukraine. The number of documents is estimated to be over 100 pages. The documents appeared online as photographs of documents atop an apparent hunting magazine, with other objects such as zip lock bags and Gorilla Glue scattered throughout the photographs. Senior U.S. officials have attested to their legitimacy, believing that the documents are intelligence and operational briefs from the Joint Staff within the Pentagon. The documents appear to be compiled from multiple sources, including the National Security Agency, the Bureau of Intelligence and Research of the State Department, and the Central Intelligence Agency (CIA); in the lattermost case, one section of the documents originates from a daily intelligence update.

In releasing the documents, the documents were first photographed and then uploaded online. According to Javed Ali, a former U.S. counter-terrorism official, the uploader of the documents may have taken steps to conceal their IP address and timestamps from the photographs in an effort to feign anonymity. The classified material would have been limited to a sensitive compartmented information facility (SCIF), where electronic devices connected to the Internet are prohibited. A senior U.S. official stated that hundreds—potentially thousands—of government officials may have obtained the documents.

Russo-Ukrainian War

Battle of Bakhmut

File:Destroyed Bakhmut.jpg

The Battle of Bakhmut is mentioned in the documents

One document dated late February 2023 detailed Russian flanking maneuvers near Bakhmut, discussions by the Ukrainian military about how to respond, and supply shortages in the area. An intelligence assessment states that as of February 25, Ukrainian forces in Bakhmut were nearly encircled; a senior Ukrainian official noted that morale was low among Ukrainian soldiers. Kyrylo Budanov, Ukraine's director of military intelligence, described the Ukrainian position as "catastrophic", and offered to deploy elite units to safeguard the single supply line and prevent encirclement. Deployment of reinforcements, including elite units, ultimately prevented the encirclement, but at a strategic cost, depleting seasoned forces that may have been in reserve for the spring counter-offensive.

Casualty estimates

The documents also cover information on U.S.-provided military resources Ukraine has access to, purported Pentagon estimates on Russian and Ukrainian casualties, and alleged information on Ukraine's planned counteroffensive. Several documents also offer "low confidence" estimates for the number of casualties, with the U.S. estimating 189,500 to 223,000 Russian casualties, compared to 124,500 to 131,000 Ukrainian casualties.

One document also states that the Armed forces of Ukraine's losses are 16,000-17,500, while the losses of the Russian Armed Forces are 35,500-43,500.

Russian military planning

The documents reveal that Russia is taking steps to combat NATO-provided tanks, such as the M1 Abrams (pictured)

In one top secret document, plans by the Russian General Staff to counter NATO-provided tanks were detailed. One such plan involves paying Russian soldiers who destroy NATO tanks. The documents also shows U.S. awareness of Russian military planning, such as plans to destroy a hangar containing drones near Odesa.

Russia-NATO aircraft encounters and near shootdown

According to one document, a Russian fighter jet nearly shot down a British surveillance plane off of the coast of Crimea. The incident, referred to as a "near-shootdown" of a Rivet Joint—a moniker referring to a variant of Boeing RC-135s—from the United Kingdom, occurred in September 2022. The incident was disclosed in October by Ben Wallace, the Secretary of State for Defence, to the House of Commons. Wallace specifically named two Sukhoi Su-27 jets as flying "recklessly", with one of the jets firing a missile at the Rivet Joint; Wallace believed the firing was a technical issue. Under the North Atlantic Treaty, such an attack could have provoked a larger response from NATO as a whole had the missile hit the plane. The document, labeled as classified for non-U.S. citizens, was among others detailing encounters that Russian fighter jets had with foreign aircraft, including the 2023 Black Sea drone incident. According to the document, French and British aircraft flew crewed reconnaissance flights between the near-shootdown and February 26, 2023.

Weapons use by Ukraine

The documents suggest that Ukraine's air defense against aircraft—largely made up of the S-300 and Buk missile systems—will be depleted by May. Several documents refer to Ukraine using weapons within Russia. According to one document, in late February, Ukrainian president Volodymyr Zelenskyy suggested the use of unmanned aerial vehicles (UAVs) to strike within the Rostov Oblast. Another document states that China could increase aid to Russia if Ukraine struck within Russia. The documents also exposed LAPIS, an advanced satellite system used by the Ukrainian military.

Proposed Foreign Equipment Transfer and Combat Brigade Organization

Documents also outline a proposed "Combat Power Build" consisting of 9 planned brigades supplied by the United States and allied partners. An additional 3 brigades are planned to be equipped, trained, and organized by the Ukrainian Armed Forces. Of note, all 9 brigades are organized as combined arms units. Each brigade has a battalion of infantry fighting vehicles or armored personal carriers supported by tanks and artillery. At the time of the publication of the document (February 2023) some brigades have tanks for which the model and supplying nation are marked - TBD (to be determined).

The equipment that is to be transferred to the Armed Forces of Ukraine includes 253 tanks, 381 tracked vehicles, 480 wheeled vehicles, 147 artillery systems, and 571 HMMWV vehicles.

Ukraine has announced that such plans may be subject to change following the leaks.

Brigade Name	IFV / APC	Tank	Artillery
116th Brigade	90 x BMP 1 (Poland / Czechia)	13 x T-64 (Ukraine) 17 x Unknown Tank (TBD)	12 x AS-90 Self-propelled 155mm Howitzer (Great Britain) 10 x 2S1 122mm Gvodika (Ukraine)
47th Brigade	99 x M2 Bradley (United States)	28 x T-55S (Slovenia)	12 x M109 Self-propelled 155mm Howitzer (United States) 12 x D-30 122mm Howitzer (Ukraine)
33th Brigade	90 x MaxxPro (United States)	14 x Leopard 2A6 (Germany) 4 x Leopard 2A4 (Canada) 14 x Leopard 2A4 (Poland)	12 x M119 105mm Howitzer (United States)
21st Brigade	20 x CVR(T) (United Kingdom) 30 x Roshel Senator (Canada) 20 x FV432 Bulldog (Great Britain) 21 x International MXT-MV Husky (Great Britain) 10 x M113 (United States)	30 x T-64 (Ukraine)	6 x FH70 155mm Howitzer (Italy) 4 x FH70 155mm Howitzer (Estonia)
32th Brigade	90 x MaxxPro (United States)	10 x T-72 (Netherlands)* 20 x Unknown Tank (TBD)	12 x D-30 122mm Howitzer (Estonia)
37th Brigade	30 x Mastiff / Husky (Great Britain) 30 x Mastiff / Wolfhound (Great Britain) 30 x Roshel Senator (Canada)	14 x AMX-10 RC (France)** 16 x Unknown Tank (TBD)	12 x D-30 122mm Howitzer (Estonia)
118th Brigade	90 x M113 (United States)	28 x T-72 (Poland)	6 x M109 155mm Self-propelled Howitzer (United States) 12 x FH-70 155mm Howitzer (Estonia)
117th Brigade	28 x BvS 10 Viking (Netherlands) 20 x XA185 (Finland / Netherlands) 10 x M113 (Finland / Netherlands) 30 x Roshel Senator (Canada)	31 x PT-91 Twardy (Poland)	8 x AS-90 Self-propelled Howitzer (Great Britain) 12 x D-30 122mm Howitzer (Estonia)
82nd Air Assault Brigade	90 x Stryker (United States) 40 x Marder (Germany)	14 x Challenger 2 (Great Britain)	24 x M119 105mm Howitzer (United States)

* The Netherlands had purchased and financed the refurbishment of T-72 from Czechia

** AMX-10 is usually classified as an armored reconnaissance vehicle but is counted as a tank in the document

Countries

Russia

A document details efforts by the GRU, Russia's military intelligence agency, to engage in information warfare in Africa that promoted "Russian foreign policy" while downplaying public opinion about the United States.

The Russian paramilitary organization Wagner Group is also mentioned. One document states that Wagner Group emissaries met with authorities from Turkey in February, suggesting that Wagner Group could obtain the weapons from an outpost in Mali. The intelligence findings suggest that Wagner chief's Yevgeny Prigozhin's claims that the Russian Defense Ministry has been skimping on ammunition supplies to Wagner may have been grounded in fact. Another document provides an estimate of the number of Wagner personnel in Mali, noting that the large Wagner presence has raised security concerns in neighboring Ivory Coast.

China

Analysis on risks posed by China are mentioned throughout the documents. An assessment found that NATO-provided weaponry could draw China into the war. Another document overviews a test of the DF-27, a ballistic missile of the Dongfeng family of missiles, that could penetrate U.S. ballistic missile defense systems. A section of the documents details a potential deployment of British naval aircraft carriers in the Indo-Pacific. Other information in the documents leak include investments in Nicaragua, a satellite rocket launch in March, and a new Chinese warship.

Egypt

Further information: Egypt–Russia relations

Several documents allege that Egyptian president Abdel Fattah el-Sisi (right) planned to sell rockets to Russia

One document overviews conversations between Abdel Fattah el-Sisi, the president of Egypt, and senior Egyptian military officials, over the production and shipment of some 40,000 rockets, and references plans by Egypt to sell artillery and gunpowder to Russia. Sisi attempted to keep the supply a secret in order to "avoid problems with 'the West'". Workers were told that the rockets were for the Egyptian army. The document references a person known only as Salah al-Din, believed to be Mohamed Salah al-Din, the minister of state for military production. Salah al-Din reportedly told Sisi that he would "order his people to work shift work if necessary" in order to repay Russia for unknown help. In addition, Sisi considered selling "ordinary stuff" to China to produce more Sakr-45 rocket launchers. Egyptian officials rejected the allegation of Egyptian rocket exports to Russia; separately, Russian officials also called it a hoax.

Iran

The documents suggest that the U.S. has been able to surveil Iran. In one document, senior Iranian leaders are described discussing an upcoming visit by Rafael Grossi of the International Atomic Energy Agency (IAEA), and how to alter domestic news coverage. The document also suggests the U.S. has been able to monitor the IAEA.

South Korea

The documents describe internal debates in South Korea regarding a request by the U.S. to provide Korean artillery shells to Ukraine, about whether it would violate South Korea's policy on lethal aid if the U.S. then sent them to Ukraine. These debates were obtained through signals intelligence conducted by the CIA. South Korea's President Yoon Suk-yeol described the leaked documents as "utterly false [...] compromising national interest". In a phone call between U.S. Secretary of Defense Lloyd Austin and his counterpart in South Korea, both countries agreed that large portions of the South Korea-related documents were fabricated.

Israel

The documents show how the U.S. sought to pressure Israel into providing lethal aid. Israel has previously denied Ukraine weaponry, including its Iron Dome air defense system. Out of four options pressed by the U.S., Israel was most likely to engage in the "Turkish model", providing weaponry to Ukraine through third-parties while remaining cordial with Russia.

One set of documents alleges that the Mossad—the national intelligence agency of Israel—encouraged staff and citizens to participate in judicial reform protests that flared up in January, following a series of changes supported by Prime Minister Benjamin Netanyahu. According to the documents, director David Barnea supported junior employees participating in the protests under the guise of anonymity. The Israeli government issued a statement denying the claims, and Israeli political commentators noted that the document appear to confuse permission with encouragement, and the actions of current and former Mossad employees.

Turkey

According to Reuters, Wagner personnel intended to purchase weapons and equipment from Turkey in order to use them in Mali and Ukraine. Leaked documents also say that the President of Mali Assimi Goïta confirmed that Mali could acquire weapons from Turkey on Wagner’s behalf.

Canada

Several documents allege that Russian cybercriminal group Zarya, acting under the direction of the Federal Security Service, compromised the IP address of an unnamed Canadian gas company and were capable of increasing valve pressure, disabling alarms, and shutting down pipelines. The reports were not confirmed.

Haiti

The documents allege that the Wagner Group is actively seeking to undermine U.S. operations in Africa, and is seeking to expand its operation into Haiti, offering to combat violent gangs on behalf of the Haitian government.

Hungary

One document from a Central Intelligence Agency (CIA) intelligence updates states that Hungarian prime minister Viktor Orban called the U.S. one of the country's "top three adversaries".

United Arab Emirates

The documents include information about American military ally United Arab Emirates' (UAE) ties with Russia, and the proposed creation of a Russian weapons repair facility in the UAE. The UAE operates weaponry from Russia, including Pantsir air defense systems and BMP-3 infantry fighting vehicles. An unaddressed concern was whether the repair of Russian weapons in the Emirates would also include Moscow's weapons that might be supplied to Kremlin forces invading Ukraine.

Leaked Russian intelligence surveilled by the U.S. indicated that Russian spies were boasting about an alleged intelligence alliance between Moscow and Abu Dhabi against the US and UK. This claim, supported only from the Russian side, was denied by Abu Dhabi as "categorically false".

Serbia

The leaked documents also alleged that Serbia supplied weapons to Ukraine in its defense against Russia, or had agreed to do so, despite Serbia refusing to economically sanction Russia.

Sources and methods

In addition to the intelligence findings themselves, the leaked documents also reveal the sources and methods of intelligence gathering, for example revealing that the CIA is using signals intelligence to spy on discussions inside the Russian Defense Ministry, as well as to eavesdrop on the South Korean and Israeli governments, and individuals associated with the Wagner Group. One document states that the U.S. has been spying on Zelenskyy. The leak further reveals which Russian agencies have been penetrated by U.S. intelligence. The leak imperils future intelligence gathering efforts as targeted governments take countermeasures and patch up revealed vulnerabilities, and also threatens human sources and whistleblowers in Russian organizations.

Investigations

The Department of Defense are assessing the leak, along with the White House, the State Department, and other intelligence agencies. The Department of Justice and Federal Bureau of Investigation (FBI) has opened a criminal inquiry into the leaker. According to Brandon Van Grack, who led the Department of Justice investigation into Edward Snowden, the Department of Justice and FBI are reviewing who may have posted the documents. Van Grack also stated that the investigation into the leak may impair the FBI investigation into Donald Trump's handling of government documents and the special counsel investigation into classified documents discovered at the Penn Biden Center and Biden's home.

Reactions

United States

The documents leak began a diplomatic crisis between the U.S. and the Five Eyes, with officials in the United Kingdom, Belgium, Germany, the United Arab Emirates, and Ukraine questioning the U.S. as to how the documents surfaced online. U.S. officials told allies that the Biden administration was investigating the leak. Wendy Sherman, the Deputy Secretary of State, has been tapped to lead the diplomatic response to the leak. U.S. Secretary of Defense Lloyd Austin described the investigation as "We will continue to investigate and turn over every rock until we find the source of this and the extent of it."

Ukraine

Ukrainian presidential advisor and peace negotiator Mykhailo Podolyak said that the leak contained a "very large amount of fictitious information" which appeared to be "standard elements of operational games by Russian intelligence and nothing more." Ukrainian defense intelligence spokesman Andriy Yusov said "in recent decades, the Russian special services’ most successful operations have been taking place in Photoshop... we see false, distorted figures on losses on both sides, with part of the information collected from open sources." On the same day Ukraine President Volodymyr Zelenskyy released a statement about a meeting with military staff in part "focused on measures to prevent the leakage of information."

Quoted by the The New York Times, Ukrainian Lieutenant Colonel Yuriy Bereza said, "We can no longer determine where is the truth and where is the lie [...] We are at that stage of the war when the information war is sometimes even more important than the direct physical clashes at the front."

Russia

Russian military analyst Yuri Kotenok claimed the slides might have been planted by the U.S. to mislead Russia and downplay the strength and readiness of Ukrainian brigades before an offensive. Kyle Walter of British firm Logically, which researches disinformation, says most voices on Russian-speaking Telegram were calling the leak a Western false flag. Conversely, Kremlin spokesperson Dmitry Peskov said that the leaks were "quite interesting", though also denied specific claims in the leak such as alleged proposal for Egyptian rocket exportation to Russia.

South Korea

Lee Jae-myung, leader of the Democratic Party of Korea, called the U.S. spying on South Korea a "disappointing act"

South Korean president Yoon Suk-yeol defended the country's relationship with U.S. and downplayed the leak, while opposition lawmakers from the Democratic Party of Korea. Lee Jae-myung, the leader of the Democratic Party, said that the leaks "[undermine] the South Korea-U.S. alliance". Kim Tae-hyo, a deputy national security advisor to Yoon, denied the veracity of conversations detailed in the documents.

Analysis

A researcher of information operations, Thomas Rid, said "The fact that unedited and edited – doctored – versions of some files are available online makes me skeptical that this is a professional Russian intelligence operation", because the falsification of casualties and other details "only makes it easier to detect the facts, and thus defeats the purpose." According to Rid and CNN, if the details were both stolen by Russia and useful to Russia, they would not have publicized both the doctored and original versions, since it would weaken their impact.

Journalist Marcy Wheeler drew attention to the server the documents originated from, noting Thug Shaker Central's conservative leanings and focus on Orthodox Christianity. Wheeler connected the server's members to three Marines who had their security clearance increased following the January 6 United States Capitol attack, in which they participated. In lieu of an official name, Wheeler named the leaks the "Thug Shaker Leaks".

The documents leak has been compared to the 2010—2011 United States diplomatic cables leak by WikiLeaks and Edward Snowden's disclosures of global surveillance information. In comparison to these leaks, the documents leak contains relatively recent information on the Russian invasion of Ukraine that could be used against Ukraine, presenting a far more drastic leak.

See also

• Active measures
• Disinformation in the Russian invasion of Ukraine
• Vulkan files leak