Leak Ledger is our weekly roundup of leaked documents, images and video. Four leaks this week: a memo to staff, a dump of personnel records, and two cases that rest on allegations.
Skydance's buyout memo to staff is printed in full by Variety
The Monday memo from David Ellison and Ynon Kreiz offered voluntary buyouts and set a five-day office week, and Variety ran the whole text from a copy it obtained. A memo sent to a whole company was always likely to get out. Had each employee been sent a watermarked attachment instead, the copy a reporter holds would point to the employee it was issued to; text that is pasted, retyped or forwarded as plain email points to no one.
Source: Variety
Hackers claim to have leaked records on tens of thousands of DHS employees
Distributed Denial of Secrets says a hacktivist group took the data from an internal DHS database linked to employees' single sign-on, and DDoSecrets posted the records online; DHS says it is investigating a potential breach, and a source told CNN some undercover personnel were exposed. If the records came out of a database, as the group says, no copy was handed to anyone, and a watermark has nothing to say about records pulled out of a system.
Source: CNN
Pentagon's top military planner fired over what an official says were leaks
A Pentagon official told CBS News that Lt. Gen. Brett Sylvia was accused of leaking classified information about the Iran and Russia-Ukraine wars and failed polygraph tests; two other Pentagon sources said those accusations are not true, and the case has been referred to the Justice Department. Whatever the facts, information passed on in conversation is beyond any watermark: it traces a copy of a file, not what someone says.
Source: CBS News
Former Fort Bragg contractor charged with posting classified imagery online
According to the indictment, a contractor with a Top Secret clearance photographed and removed classified videos and photos of military operations and posted them to a social media site, where others reposted them; he is presumed innocent. Images and video are what a per-recipient watermark is built for: if a copy issued to one person is reposted unchanged, detection can point to that copy. But the indictment says he photographed material, and a photo of a screen, or the recompression a repost goes through, can leave the watermark unrecoverable.
Source: U.S. Department of Justice
Why it matters
Only one of this week's leaks is said to involve a hack. The other three involve material held by people with access: a memo sent to a whole workforce and, in accusations that remain unproven, a general and a contractor who held clearances.
Polygraphs and access logs narrow down who could have leaked. They can't say whose copy turned up. When each recipient gets a copy with its own invisible watermark, detection reads the unique forensic ID from the leaked file, and you match it to the recipient you recorded. That covers documents, images and video. It doesn't cover audio, retyped or relayed text, records taken from a database, or a recording someone makes themselves, and it doesn't stop a leak. Our guide to invisible watermarking covers where it works and where it doesn't.