The search warrant says that the internal audit and (logged-in?) gmail account were the smoking gun. Page 11, paragraphs 14-16: https://d3vv6lp55qjaqc.cloudfr

The search warrant says that the internal audit and (logged-in?) gmail account were the smoking gun. Page 11, paragraphs 14-16: https://d3vv6lp55qjaqc.cloudfront.net/items/1k2I053M3J2z0f473l3r/show_temp%20%2866%29.pdf https://d3vv6lp55qjaqc.cloudfront.net/items/1k2I053M3J2z0f47... > 14. The U.S. Government Agency [NSA] examined the document shared by the News Outlet [The Intercept] and determined the pages of the intelligence reporting appeared to be folded and/or creased, suggesting they had been printed and hand-carried out of a secured space. > 15. The U.S. Government Agency conducted an internal audit to determine who accessed the intelligence reporting since its publication. The U.S. Government Agency determined that six individuals printed this reporting. These six individuals included WINNER. A further audit of the six individuals' desk computers revealed that WINNER had e-mail contact with the News Outlet. The audit did not reveal that any of the other individuals had e-mail contact with the News Outlet. > 16. The U.S. Government Agency determined that WINNER had e-mail communication with the News Outlet on or about March 30, 2017, and March 31, 2017. The first e-mail was from WINNER, using e-mail address [redacted].fitness@gmail.com, to the News Outlet. In it, WINNER appeared to request transcripts of a podcast. The second e-mail was from the News Outlet to [redacted].fitness@gmail.com and confirmed WINNER'S subscription to the service. The [redacted].fitness@gmail.com account is a personal e-mail account not sponsored by or affiliated with the U.S. Government Agency. Whether the 'crease' noticed by the NSA in paragraph 14 was actually creases or an internal code for microdots, if The Intercept was going to use this report there's nothing they could have done to protect this reckless source.