(CNSNews.com) – A federal contractor charged with leaking a top-secret NSA document to a media outlet was tracked down after the media outlet sent photos of the document to a government agency source – and in doing so providing investigators with vital clues that eventually led to the suspect.

The suspect, 25-year-old Reality Leigh Winner, had used her computer at work to email the media outlet, according to an affidavit released by the Department of Justice on Monday.

News of Winner’s arrest came shortly after The Intercept, an online news site that encourages whistleblowing and the leaking of official documents, published a top-secret NSA document relating to Russian hacking attempts before last November’s election.

The Intercept said the document had been “provided anonymously” and had been “independently authenticated.” It also reported that it had contacted the NSA and Office of the Director of National Intelligence, and that officials declined to comment but asked that a report on the document not be published. A number of redactions were then requested and agreed upon.

The DoJ did not identify the government agency involved in Winner’s alleged offending, but said she was “a contractor with Pluribus International Corporation assigned to a U.S. government agency facility in Georgia.” She had worked there since February, and held top-secret clearance.

The Alexandria, Va.-based Pluribus International advertises intelligence analyst and similar positions at more than a dozen locations around the nation, including Fort Gordon in Augusta, Georgia. The NSA has a large cryptologic center in Fort Gordon, which is also home to the U.S. Army Signal Corps.

Winner was arrested by the FBI at her Augusta home on Saturday and appeared in federal court in the city on Monday, charged with removing classified material from a government facility and mailing it to a news outlet. The charge, “gathering, transmitting or losing defense information,” carries penalties of up to ten years’ imprisonment.

According to an affidavit by an FBI special agent that forms part of the criminal complaint, the media outlet – not identified in the documents – sent photos of the top-secret document that had come into its possession with a source at an unnamed government agency, asking the person to determine their veracity.

That copy evidently provided valuable clues to the origin of the document.

“The  U.S. Government Agency examined the document shared by the News Outlet and determined the pages of the intelligence reporting appeared to be folded and/or creased, suggesting they had been printed and hand-carried out of a secured space.”

An internal audit then established that six individuals had accessed and printed the document concerned. Examination of the six individuals’ desk computers established that only one of them – Winner – had been in email contact with the media outlet concerned. She used a Gmail account to email the outlet at the end of March 30.

During a search of Winner’s home on Saturday, the suspect admitted to investigators that she had printed the document, removed it from work, and mailed it to the news outlet from Augusta, Ga.

According to the affidavit, Winner also acknowledged that she was aware of the contents of the document and knew that it “could be used to the injury of the United States and to the advantage of a foreign nation.”

Deputy Attorney General Rod J. Rosenstein said the suspect had been quickly identified and arrested through “exceptional law enforcement efforts.”

“Releasing classified material without authorization threatens our nation’s security and undermines public faith in government,” he said. “People who are trusted with classified information and pledge to protect it must be held accountable when they violate that obligation.”

Anti-Trump posts

According to an application for a search warrant, filed with the Augusta court, Winner was an active duty member of the U.S. Air Force since 2013, and held a top-secret clearance over that period.

A review of social media accounts that appear to belong to Winner points to a young woman with strongly negative opinions of President Trump and his policies.

In response to a Feb. 12 tweet from the president relating to the admission of refugees from terror-prone countries, the account owner tweeted, “the most dangerous entry to this country was the orange fascist we let into the white house.”

In a Jan. 31 post linking to a newspaper story on the president’s immigration executive order, she tweeted a hashtag that compares Trump to a vulgar term for female genitalia. Other hashtags to appear include #NotMyWall and #notmypresident.

The document at the center of The Intercept’s reporting deals with NSA intelligence about a Russian Military Intelligence cyberattack on a U.S. voting software supplier and attempts – through the use of spear-phishing emails – to get access to computers by fooling employees into handing over login credentials.

The NSA document said it was not known whether the attempts to compromise the targets were successful.

The Intercept encourages whistleblowers and offers advice to those who want to leak information securely.

“Don’t contact us from work. Most corporate and government networks log traffic. Even if you’re using Tor [an Internet browser that conceals a user’s IP address from the visited websites], being the only Tor user at work could make you stand out.”

“Don’t email us, call us, or contact us on social media,” The Intercept advises. “From the standpoint of someone investigating a leak, who you communicate with, and when, is all it takes to make you a prime suspect.”