One Possible Source of the Leaked Classified Documents on the War in Ukraine — A Combined Operations Center

If you want to understand how a collection of highly classified documents could be removed from a secure facility and wind up being distributed to the public, let me introduce you to a CAOC. I know that CAOC sounds a bit like CHAOS, but that is just a serendipitous coincidence. While the following images are real (they were taken at the Al Udeid Air Base in Qatar about four years ago) this particular CAOC has nothing to do with the operation underway in Ukraine. I am using it as an example of what the U.S. European Command is doing in Germany to coordinate U.S. and NATO support for Ukraine.

A Joint EUCOM, NATO, Ukrainian Operations Center would include U.S. and NATO personnel from all member countries, as well as representatives of Ukraine’s military, carrying out activities such as collecting and distributing all relevant intelligence, liaison officers who coordinate activities, such as drone Intelligence, Surveillance & Reconnaissance aka ISR, operations planning, communications and logistics.

The following paragraph and photos come from a U.S. Central Command website for United States Air Forces Central and illustrates the actual look and complexity of a Joint or Combined operations center.

The Combined Air Operations Center (CAOC) commands and controls the broad spectrum of what air power brings to the fight: Global Vigilance, Global Reach, and Global Power. Located at Al Udeid Air Base, Qatar, the CAOC provides the command and control of airpower throughout the U.S. Central Command Area of Responsibility; a 21 nation region stretching from Northeast Africa across the Middle East to Central and South Asia. (U.S. Air Force photo by Staff Sgt. Jessica Montano)

There is a room separate from what you see in these photos where the TOP SECRET information is handled. There are no photos of that room. TS material is NOT, I repeat NOT, allowed on this floor, because you have representatives from different countries working side by side. While there are some desks on this floor that handle SECRET NOFORN reports and documents, it is on screens and the personnel cleared for that sit in a separate section of the main room.

I learned today from media reports that some of the leaked information is classified as TOP SECRET because it reports on intercepted phone conversations between South Korean officials. That explains why the overall report, which contained some documents marked SECRET or SECRET NOFORN, carried the overall classification of TOP SECRET. Just because the parent document is TOP SECRET does not mean that every intelligence report in that publication is TOP SECRET.

Let me try to dispel some of the myths and falsehoods circulating the web about how this classified material made its way to the light of day.

First, no foreigners are allowed in the TOP SECRET SCIF (pronounced “skiff”). Only American citizens who hold a TS SCI clearance.

Second, the only way for that 100 plus page classified report to leave the SCIF is that it had to be printed and then physically carried out of the room (for the purpose of discussion I am assuming that the leaked material came from Operations Center that had access to the report). There is no way for anyone to take any kind of camera into a SCIF and then stand around snapping photos of classified documents. Just does not happen. Given the importance of the Ukraine mission for the U.S., the SCIF would be staffed with dozens of enlisted, officers and contractors who held TS clearances. The days of being able to copy material to a thumb drive ended thanks to Edward Snowden.

Third, it is not abnormal to print off briefings inside a SCIF. In fact, it is routine. What is not routine is that someone folded the report and hid it in some fashion to get it out of the SCIF. I have worked in SCIFs where you could bring in your backpack. So it is feasible that the leaker stuffed the report into his or her backpack and casually walked out when their shift was over. It also is possible that the person who purloined the documents folded them up and put them in a burn bag, which is routinely removed from the SCIF for shredding and destruction, and then recovered the document before it was destroyed.

Fourth, there is no way to “hack” a TS or S computer from the outside and remove material without setting off alarms.

My reason for delving into so much detail is to help you understand that when you have a leak of TS material that appeared on social media last week, it means it originated with someone in the U.S. military, the U.S. intelligence community, or a U.S. contractor working for one of those organizations (again, watch the Oliver Stone movie about Edward Snowden to gain some appreciation for the difficulty of taking highly classified printed material from a SCIF).

While the Russians have robust intelligence capabilities, I do not believe they are capable of fabricating these documents with this level of detail unless they had a recruited spy in the SCIF. If the Russians had that kind of access, why would they put out this kind of material and risk the exposure of that asset?

Many pundits and bloggers who have focused on what they consider “errors” and “falsifications” labor under the delusion that because something appears in a classified report it must be true. Not so. It is not uncommon for inaccurate or misleading information to appear in a classified document. How so? If the “intelligence data” you are reporting came from Ukrainian sources and is not fact checked against other intelligence, then you wind up presenting the ultimate Rosie Scenario.

One example of this is the claim that Russia has committed 97% of its Army to Ukraine. Congrats to Alex Christoforou who recalled in one of his recent strolling chats that the U.K.’s Defense Minister, Ben Wallace, was touting those number on February 14, 2023:

UK Defence Secretary Ben Wallace says that 97% of the Russian army is now estimated to be in Ukraine. They are suffering “First World War levels of attrition”, he tells the BBC, but rules out sending fighter jets to Ukrainian forces anytime soon.

Wallace simply repeated information that was being briefed to the NATO alliance in February 2023. That does not make it true. What is not revealed in the release of the classified documents is the actual source for that information. This is one example of how garbage information makes its way into a classified report.

One final point. The information in those documents is a snap shot of what the U.S. and NATO believed as of March 1st. That does not mean they continue to accept as true data from the 1 March time frame as of 10 April. Do not fall into the illogical trap of assuming that what was written on 1 March still applies. The war in Ukraine is a dynamic affair and the plans outlined in the leaked documents probably are no longer feasible.