The 25-year-old federal contractor now stands charged with leaking information regarding a 2016 Russian military intelligence cyberattack to The Intercept, an online news outlet.
The Justice Department announced charges Monday against Reality Leigh Winner, a contractor with Pluribus International Corp. in Augusta, Georgia. She is accused of "removing classified material from a government facility and mailing it to a news outlet," according to a federal complaint.
She is now being held at a facility in Lincolnton, Georgia, her attorney said.
-- Winner is a federal contractor with top secret security clearance. She had been assigned to a US government agency facility in Georgia since February 13.
-- She is accused of leaking classified information, used as the basis for an article published
Monday by The Intercept, detailing a classified National Security Agency memo. The NSA report, dated May 5, provides details of a 2016 Russian cyberattack on a US voting software supplier, though there is no evidence the hack affected any votes.
-- Winner was a linguist in the US Air Force and speaks Pashto, Farsi and Dari, said her mother, Billie Winner-Davis.
"She served her country; she is a veteran," her stepfather, Gary Davis, told CNN's Anderson Cooper
on Tuesday: "She's a patriot, and to see her maligned and slandered in the media is very disheartening."
-- Winner served in the Air Force from December 2010 to 2016. Her rank was senior airman, and her last duty title was cryptologic language analyst, according to the Air Force. She provided support to missions and received the Air Force Commendation Medal in 2016, which is for members who have "distinguished themselves by meritorious achievement and service."
She "provided over 1,900 hours of enemy intelligence exploitation and assisted in geolocating 120 enemy combatants," the award said.
-- She was raised in Kingsville, Texas, and served in the Air Force in Columbia, Maryland. Her mother confirmed she was a federal contractor in Augusta but did not know the nature of her work, or whether she had contracted for the NSA.
-- "Outside of work she works as a yoga instructor. She's just a normal person," her court-appointed attorney, Titus Nichols, said.
How did she become a suspect?
Winner is accused of printing the classified intelligence reporting May 9 and mailing it to a news outlet a few days later, according to the federal complaint
The Intercept contacted the NSA and the Office of the Director of National Intelligence for its article.
The news outlet provided the US government agency with a copy of the document, according to the complaint.
After examining the document, it was determined the pages of the intelligence reporting appeared to be folded or creased, "suggesting they had been printed and hand-carried out of a secured space," according to the criminal complaint.
An internal audit revealed Winner was one of six people who printed the document but the only one who had email contact with the news outlet, according to the complaint.
Prosecutors said when confronted with the allegations, Winner admitted to leaking the classified document intentionally -- and she was arrested Saturday in Augusta.
She had removed the intelligence reporting from her office and mailed it from Augusta, according to the affidavit in support of her arrest.
Nichols cast doubt on the government's side of the story, and as for the purported confession, he said, "The bigger issue is: Was my client interrogated without her attorney?"
Winner is set to go before US Magistrate Judge Brian Epps for a detention hearing Thursday in Augusta, Nichols said. The judge will determine whether to release her on bond. Winner did not enter a plea in her initial appearance Monday.
What does social media reveal?
Winner posted under a pseudonym, Sara Winners, but didn't seem concerned with concealing her identity, using a photo of herself as a profile picture and posting a selfie in February.
She posted about leaks and regularly took to social media to complain about Trump
, though her Twitter activity dropped off significantly after she began working for Pluribus in February. On Instagram, where she used the name @Reezlie, same as her Twitter handle, she mostly posted selfies from the gym or photos of food.
On Twitter, she followed Edward Snowden, WikiLeaks, several accounts with links to the hacking collective, Anonymous, and several "alt" government agency accounts that became popular after Trump's inauguration. Many of the accounts claim to be run by agency employees unhappy with Trump.
On Election Night, when it became apparent Trump would win, she tweeted, "Well. People suck. #ElectionNight"
Earlier this year, she took to Twitter to criticize Trump for golfing on weekends and later called the President an "orange fascist."
Though she didn't post explicitly about hacking or leaking, she liked and retweeted posts on the topic, including a tweet from Anonymous hinting at hacking Trump's computer and one about White House press secretary Sean Spicer's reportedly lax approach to securing his personal data.
Her last tweet appears to be from March 5, when she replied to @AnonymousPress asking, "what happened to the Feb 28th call for Trump to resign?"
Her mother said she wasn't especially political and had never praised past leakers such as Snowden to her.
"She's never ever given me any kind of indication that she was in favor of that at all," Winner-Davis said. "I don't know how to explain it."
Winner's attorney, Nichols, told CNN he was unable to confirm that the Twitter account was Winner's.
Who supports her?
WikiLeaks publisher Julian Assange called on the public to support Winner, adding that the young woman is "accused of courage in trying to help us know."
"It doesn't matter why she did it or the quality the report. Acts of non-elite sources communicating knowledge should be strongly encouraged," he tweeted.
A GoFundMe campaign was set up for her legal battle.
Nichols has described his client as a veteran, not a traitor, and -- citing a statement from Deputy Attorney General Rod Rosenstein saying leakers of classified information must be held accountable -- accused the government of pursuing Winner for political reasons.
"You don't see very often the deputy attorney general releasing a press release before a case has been prosecuted," Nichols said. "The government seems to have a political agenda. They're going after a low-level government employee."
Asked whether the leaked documents were legitimate, he responded, "If the documents are accurate, then the bigger issue is: Did Russia hack our election?"
Who opposes her?
Many officials criticized the leak.
"Just because you see something that is classified, you can't just hand that out like it's candy," said Rep. Jason Chaffetz, chairman of the House Committee on Oversight and Government Reform.
"There's a right way and wrong way to do this. If you feel compelled to share information that's classified because you're concerned about the implications, there are legal ways in which you can have whistleblower protection and go to committee for instance, on oversight, and protect your legal rights and not get yourself in trouble.
"A contractor, a federal employee cannot just take it upon themselves to bypass the classification system," Chaffetz said.
Steve Hall, former CIA chief of Russia operations, said that while leaks are part of the tensions in an open society, they could tip off the Russians to protect themselves better next time.
"It's a morally difficult situation because, yes, there is public value in these leaks, but by the same token, there's a high public intelligence price to pay and the public is less protected in the future if this stuff gets out," said Hall, a CNN national security analyst.