Clearance, access and need-to-know: three controls the Discord leak pulled apart
The documents posted on Discord were taken by a junior IT specialist whose clearance and systems access were valid, but who had no need for the material. Agencies that hold any sensitive data need separate controls for administrative access, its monitoring and its supervision.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
In early April 2023, photographs of classified US military and intelligence documents, including assessments of the war in Ukraine, were reported to be circulating online after first appearing in a small Discord chat group. On April 13 the FBI arrested a 21-year-old member of the Massachusetts Air National Guard. The next day he was charged under the Espionage Act with unauthorized retention and transmission of national defense information. He worked in an information technology role supporting his unit’s networks and held a top secret clearance. Prosecutors alleged that he had transcribed and later photographed documents he accessed at work and shared them with the group. The Defense Department said it was reviewing how intelligence was distributed and how access was controlled.
The leak was quickly framed as a clearance failure, and inquiries focused on missed warning signs. That framing was important but incomplete. The airman held a valid clearance appropriate to his job. The problem lay in the gap between his job and the information he could reach. An IT specialist needs access to systems. He does not need to read intelligence reporting. In his unit those two things had become entangled. Three controls should be designed separately, in any agency and not only those with classified material: the access model for administrative roles, monitoring of how that access is used, and supervision of the people who hold it.
The access model for administrative roles
Classified information is supposed to require both a clearance and a need-to-know: a mission reason to see specific material. In practice, need-to-know is often enforced coarsely. On a network accredited for a classification level, anyone cleared at that level who can log on may be able to browse much of what is there. Briefing products are often distributed widely so that many people stay informed.
Administrative roles complicate this. People who maintain networks, workstations and printers need broad technical permissions. Those permissions concern systems, not content. A sound access model separates the two wherever technology allows. Administrators get rights to configure, patch and restore systems without rights to open the files those systems hold. Encryption with keys held by data owners, separate administrative accounts with no mailbox or file share access, and role-based access to document repositories all help.
Distribution is the other lever. Products pushed to every cleared terminal in a unit keep many people informed, but they also maximize the number of people who can open and print them. Pull-based access, where a reader requests a product and the request is logged against a stated purpose, adds friction for legitimate readers. It also turns need-to-know into a recorded decision that someone can later review. Civilian agencies face the same choice with shared drives and broadcast reports.
Where separation is impossible, compensating controls must carry the load. Physical access to secure rooms, printers and terminals cannot be split by role in software. There, the controls are logging, monitoring and supervision.
The same principle applies in civilian agencies holding tax, benefits, health or law enforcement records. A database administrator or desktop technician needs to keep systems running, not to read case files. A practical starting point is a list of every privileged role, the systems it administers, and whether it can also read content. Each yes needs either a fix or a documented reason.
Monitoring how access is used
The second control is detection. Even with good design, some people will legitimately be able to reach information they should not read. National policy requires user activity monitoring on classified networks as part of insider threat programs. Many civilian systems holding sensitive data log access too.
The value of monitoring depends on whether anyone looks for activity that does not fit the role. Examples include an IT specialist searching for or printing intelligence products, a benefits clerk opening records of people outside the caseload, or a contractor querying records at unusual hours. Monitoring works when it is tuned to role: it asks what this person’s job requires and flags departures from that. Generic rules produce alerts that nobody can review.
That makes the access model and the monitoring dependent on each other. Monitoring needs a documented definition of normal activity for each role. An agency with heavy monitoring but no such definition generates noise. An agency with a clear model but no monitoring never learns when the model is breached. Useful measures include the share of privileged roles with a documented activity baseline, the number of role-deviation alerts reviewed within a set time, and how often reviews lead to action.
Monitoring also carries costs and limits. It requires trained analysts, clear legal authority, and rules on privacy that the workforce understands. It works best when staff know it exists, which deters some misuse on its own.
Supervising the people who hold access
The third control is human. Reporting on the case described colleagues and supervisors who had noticed concerning behavior, including searches for material unrelated to his duties. Later reviews examined why that did not lead to decisive action. The pattern is common in insider cases. Someone saw something, but the reporting path was unclear, the behavior seemed minor, or the observer did not want to cause trouble for a colleague.
Supervision of privileged staff needs to be explicit. Supervisors should know what their technical staff can access, which behaviors should prompt a report, and exactly where to report. Reporting is more likely when it is framed as protecting the mission and the individual, and when people see reports handled fairly. Night shifts and small detachments need particular attention. Where technical staff are junior and supervisors are focused on other duties, the people with the broadest access can be the least supervised.
These controls also limit external attacks. A stolen administrator credential is dangerous for the same reasons a careless insider is. Separating technical from content access, monitoring by role and supervising privileged staff reduce both risks at once.
With hindsight
The airman pleaded guilty in March 2024 and was sentenced in November 2024 to 15 years in prison. An Air Force inspector general review made public in December 2023 found that members of his unit had been aware of concerning activity and had not taken proper action. It cited weak supervision, including of night shift operations, and the Air National Guard disciplined 15 people, including the wing commander, who was relieved. The Defense Department tightened distribution of intelligence products and oversight of facilities handling classified material. The government also continued expanding continuous vetting of cleared personnel. Of the three controls, supervision has proved the hardest to fix. Technical separation and monitoring can be specified, bought and audited. Whether supervisors notice and report problems depends on training, staffing and culture, and it is the control most likely to erode quietly.