DOJ has unsealed the arrest affidavit for Jack Teixeira.
It describes the following investigative steps (and leaves out the one that Bellingcat got to first):
April 9 [Not described]: Based on conversations with the guys involved, Aric Toler lays out how documents traveled from servers we now know were operated by Teixeira onto WowMao.
April 10: FBI interviews the user who cross-posted a document released by Teixeira (this may be Lucca), who provided information about how Teixeira had first leaked text, then leaked documents, as well as providing basic information about Teixeira.
On or about April 10, 2023, the FBI interviewed a user of Social Media Platform 1 (“User 1”). According to User 1, an individual using a particular username (the “Subject Username”) began posting what appeared to be classified information on Social Media Platform 1 in or about December 2022 on a specific server (“Server 1”) within Social Media Platform 1. According to User 1, the individual using the Subject Username was the administrator of Server 1. User 1 indicated that the purpose of Server 1 was to discuss geopolitical affairs and current and historical wars.
According to User 1, the individual using the Subject Username initially posted the Government Information as paragraphs of text. However, in or around January 2023, the Subject Username began posting photographs of documents on Server 1 that contained what appeared to be classification markings on official U.S. Government documents.
[snip]
User 1 also described to the FBI his interactions with the individual posting under the Subject Username. In the course of those interactions, User 1 learned that the individual posting under the Subject Username called himself “Jack,” appeared to reside in Massachusetts, and claimed that he was in the United States Air National Guard (“USANG”). User 1 described the individual posting under the Subject Username as a white male who was clean-cut in appearance and between 20 and 30 years old.
April 12: Subpoena returns from Discord reveal that Teixeira registered the server in question under his own name, from his mom’s address, which is the same address the Air National Guard had for him.
According to these records, the individual using the Subject Username is the administrator of Server 1, the billing name associated with the Subject Username is “Jack Teixeira,” and the billing address associated with the Subject Username is a specific residence in North Dighton, Massachusetts. Teixeira listed the North Dighton, Massachusetts residence as his primary residence on employment paperwork with the USANG. On April 13, 2023 the FBI arrested TEIXEIRA at that residence in North Dighton, Massachusetts.
April 13: User1 gave a positive ID of Teixeira based on his driver’s license
On April 13, 2023, User 1 also identified TEIXEIRA’s Registry of Motor Vehicles photo from a photo lineup as the individual he knew as “Jack” who had posted Government Information under the Subject Username on Social Media Platform 1.
nd: OGA1 provides log files showing Teixeira printing out the single charged document the day before it got cross-posted.
The Government Document posted on Social Media Platform 1 was accessible to TEIXEIRA by virtue of his employment with USANG. According to a U.S. Government Agency, which has access to logs of certain documents TEIXEIRA accessed, TEIXEIRA accessed the Government Document in February 2023, approximately one day before User 1 reposted the information on the Internet. User 1 told the FBI that the information he reposted was originally posted on Server 1 by the individual using the Subject Username.
nd: OGA2 provides log files showing Teixeira searching for this leak investigation the day the leak was first reported.
In addition, according to a second U.S. Government Agency, which can monitor certain searches conducted on its classified networks, on April 6, 2023, TEIXEIRA used his government computer to search classified intelligence reporting for the word “leak.” The first public reporting regarding the Government Information appeared on or around April 6, 2023. Accordingly, there is reason to believe that TEIXEIRA was searching for classified reporting regarding the U.S. Intelligence Community’s assessment of the identity of the individual who transmitted classified national defense information, to include the Government Document.
Update: Spelling error of Teixeira fixed.