By Idrees Ali

WASHINGTON (Reuters) -Classified documents that appeared online, with details ranging from Ukraine’s air defenses to Israel’s Mossad spy agency, have U.S. officials scrambling to identify the leak’s source, with some experts saying it could be an American.

Officials say the breadth of topics addressed in the documents, which touch on the war in Ukraine, China, the Middle East and Africa, suggest they may have been leaked by an American rather than an ally.

“The focus now is on this being a U.S. leak, as many of the documents were only in U.S. hands,” Michael Mulroy, a former senior Pentagon official, told Reuters in an interview.

U.S. officials said the investigation is in its early stages and those running it have not ruled out the possibility that pro-Russian elements were behind the leak, which is seen as one of the most serious security breaches since more than 700,000 documents, videos and diplomatic cables appeared on the WikiLeaks website in 2013.

The Russian embassy in Washington and the Kremlin did not respond to requests for comment.

Following disclosure of the leak, Reuters has reviewed more than 50 documents labeled “Secret” and “Top Secret” that first appeared last month on social media websites, beginning with Discord and 4Chan. While some of the documents were posted weeks ago, their existence was first reported on Friday by the New York Times.

Reuters has not independently verified the authenticity of the documents. Some giving battlefield casualty estimates from Ukraine appeared to have been altered to minimize Russian losses. It is not clear why at least one is marked unclassified but includes top secret information. Some documents are marked “NOFORN,” meaning they cannot be released to foreign nationals.

Two U.S. officials told Reuters on Sunday that they have not ruled out that the documents may have been doctored to mislead investigators as to their origin or to disseminate false information that may harm U.S. security interests.

The White House referred questions to the Pentagon.

In a statement on Sunday, the Pentagon said it was reviewing the validity of the photographed documents that “appear to contain sensitive and highly classified material.”

The Pentagon has referred the issue to the Department of Justice, which has opened a criminal investigation.

One of the documents, dated Feb. 23 and marked “Secret,” outlines in detail how Ukraine’s S-300 air defense systems would be depleted by May 2 at the current usage rate.

Such closely guarded information could be of use to Russian forces, and Ukraine said its president and top security officials met on Friday to discuss ways to prevent leaks.

WATCHING ALLIES

Another document, marked “Top Secret” and from a CIA Intel update from March 1, says the Mossad intelligence agency was encouraging protests against Israeli Prime Minister Benjamin Netanyahu’s plans to tighten controls on the Supreme Court.

The document said the U.S. learned this through signals intelligence, suggesting the United States had been spying on one of its most important allies in the Middle East.

In a statement on Sunday, Netanyahu’s office described the assertion as “mendacious and without any foundation whatsoever.”

Another document gave details of internal discussions among senior South Korean officials about U.S. pressure on Seoul to help supply weapons to Ukraine, and its policy of not doing so.

The office of South Korean President Yoon Suk Yeol said on Monday that fact checks on the documents are a priority and that it would request the U.S. to take “appropriate” steps after confirming details.

Yoon’s office said the possibility that the documents were fabricated or a product of third-party interference cannot be ruled out, warning any attempts to “disrupt the alliance would face repercussions”.

Some lawmakers of South Korea’s main opposition Democratic Party expressed “strong regret” over the spying allegations, calling them a clear violation of national sovereignty and a major security failure of the Yoon administration.

“We strongly demand a thorough investigation and urge that similar incidents do not occur,” the lawmakers said in a joint statement.

The Pentagon has not addressed the contents of any specific documents, including the apparent surveillance of allies. 

Two U.S. officials, speaking on condition of anonymity, said that while there was concern about the leak at the Pentagon and intelligence agencies, the documents showed a snapshot in time from more than a month ago, rather than more recent assessments.

The two officials said the military and intelligence agencies were looking at their processes for how widely some of the intelligence is shared internally.

Officials are looking at what motivations a U.S. official or a group of officials would have in leaking such sensitive information, said one of the officials who spoke to Reuters.

The official said investigators were looking at four or five theories, from a disgruntled employee to an insider threat who actively wanted to undermine U.S. national security interests.

(Reporting by Idrees Ali; Additional reporting by Soo-hyang Choi and Hyonhee Shin in Seoul; Editing by Don Durfee, Daniel Wallis, Diane Craft and Gerry Doyle)

---