Reality Winner and the Contractor Gap

What Reality Winner Leaked

On May 5, 2017, the NSA produced a top secret report on Russian interference in the 2016 election. The report revealed:

• Russian military intelligence (GRU) had launched cyberattacks against a U.S. voting software supplier
• Over 100 local election officials received spear-phishing emails designed to steal credentials
• The attacks occurred just days before the November 2016 election

Reality Winner, a 25-year-old Air Force veteran working as a translator for the contractor Pluribus International Corporation at an NSA facility in Georgia, saw the report. She printed it and mailed it to The Intercept.

At the time, the Trump administration was publicly downplaying Russian election interference. The document proved the U.S. intelligence community had concrete evidence of attacks on election infrastructure, evidence that contradicted the administration's narrative.

Why It Mattered

Before Winner's leak, public debate about Russian interference focused on social media manipulation and hacked emails. The NSA report added a critical dimension: Russia had attempted to compromise voting systems themselves.

This wasn't about changing votes (the document didn't prove that happened). It was about proving the Russian government had actively targeted election infrastructure: something with obvious implications for election security going forward.

How She Got Caught

Winner was arrested four days after The Intercept published its story, before the publication even went live publicly.

The failure was catastrophic:

• The Intercept sent a scanned copy of the document to the NSA for verification before publishing
• The scan showed the document had been printed and folded: physical markings that narrowed the source pool
• Investigators identified only six people who had printed the document
• Winner had also used her work computer to email The Intercept, creating a digital trail

Basic operational security would have prevented her identification. She printed a document, creating a traceable paper trail. She communicated from a work computer. She allegedly admitted to the leak during FBI questioning without a lawyer present.

The Intercept's handling of the material drew sharp criticism from press freedom advocates. By sharing the physical document with the NSA, they had effectively helped identify their own source.

The Prosecution

Winner was charged under the Espionage Act of 1917. The government sought a 10-year sentence.

Like every Espionage Act defendant, Winner could not:

• Argue that her disclosure served the public interest
• Explain to the jury why she believed Americans should know about election attacks
• Claim she was exposing wrongdoing rather than harming national security

In June 2018, she pleaded guilty and was sentenced to 5 years and 3 months: the longest sentence ever imposed for an unauthorized release of classified information to the media.

For context: she got more time than many people convicted of actual espionage (selling secrets to foreign powers).

The Intelligence Contractor Protection Gap

Reality Winner had no viable legal channel to blow the whistle. This wasn't because she failed to use one. It's because no meaningful protection exists for intelligence contractors.

What the Law Actually Says

The 2013 Removal of Rights

Intelligence contractors briefly had stronger protections. The National Defense Authorization Act for 2008 extended whistleblower rights to Defense Department contractors, covering about 60% of government contractors including those at NSA and DIA.

Those protections were removed in 2013.

The timing was notable: this happened the same year Edward Snowden, an NSA contractor, made his disclosures. By the time Reality Winner was deciding whether to leak, the legal protections that might have covered her had already been stripped.

What "Protection" Actually Means

The current framework for IC contractors (Presidential Policy Directive 19) protects against only one thing: losing your security clearance as retaliation. It does not protect against:

• Being fired
• Criminal investigation
• Criminal prosecution

And there's no access to courts to challenge any of this.

Whistleblower attorney Mark Zaid called excluding contractors "a remarkable and obviously intentional oversight, given the significant number of contractors who now work within the intelligence community."

The "Use Internal Channels" Myth

Defenders of the status quo argue that whistleblowers should report internally, to inspectors general or congressional intelligence committees, rather than leaking to the press.

The problem: those channels don't work.

Thomas Drake's Experience

Thomas Drake, an NSA executive, discovered massive waste and potential constitutional violations in a surveillance program. He did everything "right":

• Reported concerns through official channels
• Cooperated with the Department of Defense Inspector General
• Testified to congressional oversight committees

The result: years later, the FBI raided his home. He was indicted under the Espionage Act, facing 35 years in prison. The case eventually collapsed, but only after destroying his career and finances.

Why Internal Channels Fail

• No enforcement: The Intelligence Community Whistleblower Protection Act lets you report, but doesn't protect you from retaliation
• Classification barriers: You can't tell Congress about classified wrongdoing unless specific intelligence committees are willing to hear it
• Inspector general limitations: IGs can investigate, but they can't compel action
• Time: Internal processes take years. By the time they conclude, the wrongdoing has continued

Daniel Ellsberg, after watching this pattern repeat across decades, concluded: "I wasted years trying to do it through channels... That was a fruitless effort, as it would have been for Manning and Snowden," and, implicitly, for Winner.

Aftermath

Reality Winner served over four years in federal prison, including time in a COVID-ravaged Texas facility where she contracted the virus. She was released in June 2021 under supervised release to a halfway house, and her sentence ended in 2022.

Life After Prison

In September 2025, Winner published a memoir titled I Am Not Your Enemy. The book had to be submitted to the NSA for screening before publication. She remains bound by her non-disclosure agreement.

She's now studying veterinary technology at Texas A&M University Kingsville and works as a CrossFit coach. But as a convicted felon, she can never become a licensed veterinary technician: she can take the certification exam to help her school's passing rates, but not actually practice.

She's also prohibited from earning money from her story. She can't even receive a free copy of her own memoir.

In interviews, Winner has expressed complicated feelings about her choice: "I think now in 2025... I'm doing fantastic. I survived. I'm great. I want people to know, just as a beacon of hope, you can start something and you might be OK at the end of it."

But she's also acknowledged the costs were enormous. And the document she leaked (proof of Russian attacks on election systems) came out anyway. The public interest was served. She paid the price.

The Deliberate Gap

The lack of protection for intelligence contractors isn't an accident. It's a design choice.

The intelligence community increasingly relies on contractors. Estimates suggest contractors make up 30-70% of the intelligence workforce depending on the agency. Edward Snowden was a contractor. Reality Winner was a contractor. The people with access to classified information are often the people with the least legal protection.

This creates a system where:

• The government gets plausible deniability (contractors aren't "really" government employees)
• Contractors can be terminated without civil service protections
• Whistleblower routes that exist for regular employees don't apply
• The Espionage Act applies fully, with no offsetting protections

Jesselyn Radack, a whistleblower attorney, summarized: "The best way for the government to stop leaks is to enact meaningful and effective whistleblower protection. It is appalling that... national security and intelligence contractors still have no viable channels through which they can expose fraud, waste, abuse and illegality."

Instead, the government chose punishment over prevention. The message is clear: if you're a contractor who discovers wrongdoing, you have no safe way to report it. Your choice is silence or prison.

The Bottom Line

Reality Winner exposed evidence that a foreign power had attacked U.S. election systems. For that, she received the longest sentence ever imposed for a leak to the media.

She had no legal protection because intelligence contractors are explicitly excluded from whistleblower laws. The protections that briefly existed were stripped in 2013. The "internal channels" alternative has a track record of failure.

The system is working as designed. It's designed to ensure that the people with the most access to government secrets have the strongest incentive to stay silent, even when they witness crimes, constitutional violations, or threats to democracy.

Winner's case isn't an outlier. It's the template. And until the contractor gap is closed, anyone in her position faces the same impossible choice: comply with secrecy or accept years in prison.

References

1. Wikipedia: Reality Winner
2. Brennan Center: National Security Whistleblowing: A Gap in the Law
3. Government Accountability Project: IC Contractors Lack Protections
4. NPR: Reality Winner Memoir
5. Freedom of the Press: Reality Winner and the Espionage Act
6. Slate: Reality Winner Interview
7. House Whistleblower Caucus: IC Whistleblowing Fact Sheet

Related

• The Espionage Act: From WWI to Whistleblowers
• Edward Snowden: A Decade Later
• Whistleblower Protection Laws: What They Actually Cover
• The Pentagon Papers: How Leaks Changed History