# How a Leak Is Investigated and Prosecuted A story appears. It contains something the government did not want published. Somewhere inside a federal agency, a lawyer now has to decide what to do about it, and the machinery that follows is almost entirely invisible from the outside — it produces, in most cases, no docket, no filing and no public record of any kind. This page maps that machinery end to end: how a disclosure gets noticed, who is required to report it and to whom, the screen that decides whether anyone investigates, what the FBI actually does, what the government can charge, what defenses the accused does not have, and — running alongside all of it — the personnel track that resolves most of these matters without a criminal charge ever being filed. ⭐ **The organizing finding is that there is no leak statute.** Nothing in federal law makes it a crime, in general terms, to give classified information to a reporter. The charge in nearly every one of these cases is [[Espionage Act of 1917]] § 793, a 1917 statute written against spies, which does not contain the word "classified" and asks instead whether information "relating to the national defense" was passed to someone not entitled to receive it. The one statute that does turn on classification, 18 U.S.C. § 798, reaches only four narrow categories — codes, ciphers, cryptographic equipment and communications intelligence. Everything else is prosecuted under a law that was not written for it. **The second finding is the shape of the funnel, and it is steep.** In the only period for which figures have been published in detail, 2005 through 2009, intelligence agencies sent the Justice Department 183 referrals of unauthorized disclosure. The FBI opened 26 investigations. Those 26 identified 14 suspects. Over an earlier and longer window, September 2001 to February 2008, the FBI opened and closed 85 media-leak investigations and **none of them produced a prosecution**. ◈ A criminal charge is not the normal outcome of a leak referral; it is the rare one. **The third finding is that the disposition happens on the other track.** When the FBI declines, or the Justice Department declines to prosecute, the referring agency is free to act on its own, and it does — a reprimand, a suspension of access, a revoked clearance, a termination. That track requires no indictment, no grand jury and no proof beyond a reasonable doubt, only a determination that continued access is not "clearly consistent with the interests of national security." Under *[[Department of the Navy v. Egan]]* the merits of that determination are substantially beyond judicial review. ◎ The criminal route is the visible minority; the personnel route is the disposition. **The fourth finding is that the rule protecting reporters says, in its own text, that it protects nobody.** The Justice Department's news-media policy at 28 C.F.R. § 50.10 requires the Attorney General's personal authorization before a subpoena, a search warrant or a court order may be directed at a journalist's records. Its final paragraph, § 50.10(i), states that the policy does not create any right or benefit enforceable at law or in equity by any party. ✕ What stands between a reporter and compulsory process is an internal sign-off requirement, revisable at will — and in April 2025 it was revised. **The fifth finding is that the numbers exist, Congress required them to be unclassified, and they are not published.** A statute passed for exactly this purpose, 50 U.S.C. § 3235, obliges every intelligence community element and the Assistant Attorney General for National Security to report twice a year on unauthorized-disclosure investigations: how many opened, how many closed, how many referred, whether each was substantiated, the classification level involved, and whether charges were filed. The statute says the reports "shall be unclassified" with a classified annex permitted. They go to four congressional committees. ◈ No public version is required and none is routinely released, which is why the most detailed figures anyone can cite are from the 2000s. **The sixth finding is about the screen itself.** Before the Justice Department will open a criminal leak investigation, the referring agency must answer a set of eleven questions, known inside the system as the Traditional 11 Questions, on a form the Department calls the Media Leak Questionnaire. They ask what was disclosed, whether it was accurate, how damaging it was, how many people had access and whether the information could have come out lawfully. ◈ Read together they are a prosecutability screen rather than a harm screen — they measure how findable the leaker is. None of them asks whether finding the leaker would require going through a journalist. > [!note] How to read this chart > `──▶` = the main path · `└─▶` = a branch · `■` = a stage · `◆` = a step or instrument inside a stage · `◇` = a decision point · `☐` = a document is created here · `⊘` = a route foreclosed by statutory text · `◎` = the hinge, the point where the criminal track stops and something else decides · `✕` = a requirement that does not bind · `⚑` = a duty with no due date · `⏳` = a clock runs here · `★` = used or decided in 2025–26 · `◈` = a count or reading made on this page rather than published anywhere. Section numbers are 18 U.S.C. unless marked otherwise. No officeholder is named inside the chart; names, with their dates, are in the Notes. Officeholders on this page were verified in October 2026. ``` HOW A LEAK IS INVESTIGATED AND PROSECUTED (October 2026) │ From a published story to a criminal charge - and the shorter route that │ gets taken instead. │ Reporting duties: 28 U.S.C. § 535 · E.O. 12333 § 1.6(b) · 1995 interagency MOU │ Procedure: ICD 701 (3 Oct 2017) · Charges: §§ 793, 798, 641, 1924, 1001 │ The press: 28 C.F.R. § 50.10 · Reporting to Congress: 50 U.S.C. § 3235 │ ☐ a document is created here ⊘ foreclosed by statutory text │ ◎ the hinge: the criminal track stops, something else decides │ ✕ a requirement that does not bind ⚑ a duty with no due date │ ⏳ a clock runs here ★ used or decided in 2025-26 │ ◈ a count or reading made on this page │ ■ STAGE 0 — THE DISCLOSURE IS NOTICED │ │ ├─◆ Published. A story, a broadcast, a book. The usual trigger, and the │ │ only one a member of the public ever sees. │ ├─◆ Detected internally. Audit logs, system monitoring and insider-threat │ │ tooling, governed by ICS 500-27 and ICS 700-2. │ └─◆ Self-reported, or reported by a colleague. Every cleared employee is │ under a standing duty to report suspected unauthorized disclosures, │ including disclosures by people who do not work for the government. │ │ ⊘ NOT a trigger on its own: the fact that the information was classified. │ Someone has to decide the disclosure was unauthorized AND that it was │ damaging enough to be worth reporting. │ ──▶ ■ STAGE 1 — THE PRELIMINARY INQUIRY (the agency, not the Justice Department) │ │ Run by the General Counsel of the agency the information came FROM, with │ subject-matter experts. Deliberately narrow: agency records, public │ information, and interviews with people other than the suspect. │ │ ├─◆ ⏳ Within SEVEN BUSINESS DAYS of opening the inquiry, the head of the │ │ element notifies the Intelligence Community Inspector General, its own │ │ Inspector General, and any other element whose information is involved. │ ├─◆ The inquiry answers the eleven questions at Stage 2. │ └─◆ ⊘ The inquiry may NOT interview the suspect, polygraph anyone, or seize │ evidence. Those steps belong to Stage 4 and need the Department first. │ │ ◇ Is there a reasonable basis to believe a federal crime occurred? │ ├─ no ──▶ ◎ the matter stays inside the agency. Go to PARALLEL TRACK. │ └─ yes ──▶ Stage 2 │ ──▶ ■ STAGE 2 — THE ELEVEN QUESTIONS (the screen that decides whether anyone looks) │ │ ☐ A questionnaire the referring agency must complete before the Justice │ Department will open a criminal leak investigation. Known inside the system │ as the Traditional 11 Questions. What they go to: │ │ ┌───────────────────────────────────┬──────────────────────────────────────────────┐ │ │ WHAT THE QUESTIONS MEASURE │ WHY IT DECIDES THE CASE │ │ ├───────────────────────────────────┼──────────────────────────────────────────────┤ │ │ What exactly was disclosed │ Fixes the charge and the classification │ │ │ │ level │ │ │ Whether it is accurate │ Inaccurate leaks are rarely pursued │ │ │ How damaging it was │ The only genuinely harm-facing question │ │ │ How widely it had spread │ Information already public is not covered │ │ │ How many people had lawful access │ The decisive one: a short access list is a │ │ │ │ findable leaker │ │ │ Whether lawful release was │ Separates a leak from an authorised │ │ │ possible │ disclosure │ │ └───────────────────────────────────┴──────────────────────────────────────────────┘ │ │ ✕ NONE of the eleven asks whether identifying the leaker would require │ compulsory process against a journalist. That question is not part of │ the screen. It arrives at Stage 5, and one official answers it. │ ──▶ ■ STAGE 3 — THE CRIMES REPORT (the referral itself) │ │ ☐ A written report from the agency's General Counsel to the Justice │ Department. Three separate authorities require it: │ │ ├─◆ 28 U.S.C. § 535 — the general duty of an agency to report possible │ │ federal criminal violations to the Attorney General. │ ├─◆ E.O. 12333 § 1.6(b) — the intelligence-community-specific duty. │ └─◆ The 1995 interagency Memorandum of Understanding on the reporting of │ federal crimes, which is what sets the form in practice. │ │ The element simultaneously notifies its own Inspector General, the │ Intelligence Community Inspector General, and the Director of the National │ Counterintelligence and Security Center. │ │ ├─◆ ⚑ There is no deadline on the crimes report itself. The seven-day clock │ │ at Stage 1 runs on NOTIFICATION, not on referral. │ └─◆ One route is mandatory and immediate: any indication the information │ reached a FOREIGN POWER goes to the FBI at once. ⊘ That is a │ counterintelligence matter, and it bypasses the screen entirely. │ ──▶ ■ STAGE 4 — THE TIER DECISION (what, if anything, happens next) │ │ Made by the National Security Division together with the referring agency. │ Three outcomes: │ │ ├─◆ TIER 1 — nothing further. The preliminary inquiry was the whole │ │ investigation. ◈ On the published numbers this is where most referrals │ │ end, and it leaves no record anyone outside the agency can see. │ ├─◆ TIER 2 — the agency investigates internally, once the Department │ │ concurs. ⏳ Until the Department concurs, asks for more, or 21 days │ │ pass from notification — whichever comes first — the agency must avoid │ │ any step that could damage a criminal case: no subject interview, no │ │ polygraph, no seizure of evidence. │ └─◆ TIER 3 — the FBI investigates, at the Department's request. This is the │ only tier that can end in a courtroom. │ │ ◇ Does the FBI take it, or does the Department decline? │ ├─ declines ──▶ ◎ the two Inspectors General decide whether an │ │ ADMINISTRATIVE investigation is warranted instead. │ │ Go to PARALLEL TRACK. │ └─ takes it ──▶ Stage 5 │ ──▶ ■ STAGE 5 — THE INVESTIGATION │ │ FBI agents, supervised by National Security Division lawyers and the │ relevant United States Attorney's office. │ │ ├─◆ THE ORDINARY ROUTE — start from the access list. Who could have seen │ │ the document, who printed it, who badged into the space, who carried a │ │ phone out of it. Metadata before testimony, because metadata needs no │ │ witness — and no reporter. │ ├─◆ ★ WORKED EXAMPLE (January 2026). A cleared contract systems engineer │ │ was charged with five counts of unlawful transmission and one of │ │ unlawful retention under § 793(e), after allegedly printing classified │ │ reports, removing them from a secure facility and passing them to a │ │ reporter. The evidence described in the public filings is phone │ │ messages recovered in a court-authorised search and a document found │ │ in a vehicle. The physical trail, not the journalist. │ └─◆ THE PRESS ROUTE — 28 C.F.R. § 50.10. A subpoena, a § 2703(d) order, a │ § 3123 order, a search warrant, or the questioning, arrest or charging │ of a journalist for conduct arising from newsgathering, each requires │ the ATTORNEY GENERAL'S OWN AUTHORIZATION, cleared first by the │ responsible United States Attorney or Assistant Attorney General. │ ├─ ☐ § 50.10(e): the journalist should normally get advance notice, │ │ and the risk that notice would DELAY the investigation is │ │ expressly not a sufficient reason to withhold it. Where notice is │ │ withheld it must follow within 45 days of the return, extendable │ │ once by 45 days, and never beyond 90. │ ├─ ☐ § 50.10(c)(4)(iv): in a leak case specifically, the Attorney │ │ General may authorise process once the originating agency │ │ certifies the harm. │ └─ ✕ § 50.10(i): the policy "does not, create any right or benefit" │ enforceable at law or in equity by any party. │ ◎ THE WHOLE PROTECTION IS AN INTERNAL SIGN-OFF RULE, AND THE │ OFFICIAL WHO SIGNS IS THE ONE WHO SETS IT. │ ★ Rescinded and rewritten in April and May 2025 — see the Notes. │ ──▶ ■ STAGE 6 — THE CHARGE (and the statute that does not exist) │ │ ⊘ THERE IS NO GENERAL LEAK STATUTE. No federal provision makes it a crime, │ as such, to give classified information to the press. What exists: │ │ ┌────────────────────┬────────────────────────────────────────┬────────────────────────────────┐ │ │ PROVISION │ WHAT IT ACTUALLY REACHES │ WHAT IT TURNS ON │ │ ├────────────────────┼────────────────────────────────────────┼────────────────────────────────┤ │ │ Section 793(d), │ Retaining or communicating information │ The phrase "relating to the │ │ │ (e) │ relating to the national defense. The │ national defense" - not the │ │ │ │ workhorse. │ word "classified" │ │ │ Section 798 │ Codes, ciphers, cryptographic │ The fact of classification. │ │ │ │ equipment, communications │ The only provision where that │ │ │ │ intelligence. Four categories only. │ is the element │ │ │ Section 641 │ Theft or conversion of government │ Information treated as │ │ │ │ property │ property │ │ │ Section 1924 │ Removing or keeping classified │ Possession, not disclosure. A │ │ │ │ material in an unauthorised place │ five-year felony since January │ │ │ │ │ 2018 │ │ │ Section 1001 │ False statements to investigators │ The interview, not the leak │ │ └────────────────────┴────────────────────────────────────────┴────────────────────────────────┘ │ │ What "relating to the national defense" requires, as courts have read it: │ the information must concern military activity, intelligence or foreign │ policy; it must be CLOSELY HELD, meaning the government kept it from the │ public and it has not otherwise been published; and its disclosure must be │ potentially damaging to the United States or useful to an adversary. │ Actual harm need not be proved. Information the government has already │ made public falls outside the prohibition. │ ──▶ ■ STAGE 7 — THE DEFENSES THAT DO NOT EXIST │ │ ├─◆ ⊘ NO PUBLIC-INTEREST DEFENSE. That the disclosure exposed waste, error │ │ or wrongdoing is not an answer to the charge. Courts have indicated │ │ that a patriotic motive would not change the outcome. │ ├─◆ ⊘ NO MOTIVE ELEMENT TO REBUT. The government need not prove an evil │ │ motive. Knowing the information could injure the United States or help │ │ a foreign nation satisfies the mental state. │ ├─◆ ⊘ UNDER § 798, NO CLASSIFICATION CHALLENGE AT ALL — the propriety of │ │ the classification is not an element and not a jury question. Under │ │ § 793 the fight is narrower than it sounds: whether information │ │ relates to the national defense goes to the jury, but classification │ │ is strong evidence and the executive's judgment draws deference. │ └─◆ ⚑ WHAT THE DEFENDANT MAY SEE AND SHOW at trial is settled in a separate │ procedure, litigated by the prosecuting party. That is its own map. │ │ ◇ Does the case reach a verdict? │ ├─ graymail ──▶ the government must weigh confirming sensitive material │ │ in open court. Historically this has produced pleas and │ │ dismissals as often as verdicts. │ └─ verdict ──▶ sentence · and ◎ the clearance is gone either way │ ══▶ ■ THE PARALLEL TRACK — WHAT HAPPENS WHEN THE CRIMINAL ROUTE CLOSES │ │ ◎ THIS IS THE DISPOSITION IN MOST CASES. It is available at every exit │ above: after a Tier 1 closure, after an FBI declination, after a │ Department declination, after an acquittal, and during a prosecution. │ │ ├─◆ Guideline K of the national security adjudicative guidelines, titled │ │ HANDLING PROTECTED INFORMATION, treats deliberate or negligent failure │ │ to protect classified or other sensitive information as a security │ │ concern in its own right. It needs no charge and no conviction. │ ├─◆ The standard is not proof beyond a reasonable doubt. It is whether │ │ continued access is CLEARLY CONSISTENT with the interests of national │ │ security — a formula that resolves doubt against the employee. │ ├─◆ ☐ A suspension or revocation of access is recorded in Scattered │ │ Castles, the community-wide clearance database. ◈ That record follows │ │ the person to every cleared employer, which is the practical sanction │ │ whether or not anything else ever happens. │ ├─◆ ☐ Classification violations are reported to the Information Security │ │ Oversight Office. │ └─◆ ⊘ JUDICIAL REVIEW IS LARGELY FORECLOSED. Under Department of the Navy │ v. Egan (1988) the substance of a clearance determination is committed │ to the executive. Procedure can be challenged; the judgment generally │ cannot. │ │ ◈ A person can lose a career, a clearance and future employability on this │ track without ever being charged, and none of it is published. │ ──▶ ■ THE REPORTING THAT GOES UP, AND STOPS │ │ 50 U.S.C. § 3235 requires reports "not less frequently than once every │ 6 months": │ │ ├─◆ FROM each intelligence community element head and each inspector │ │ general with oversight of one: investigations opened, investigations │ │ completed, and of those completed, how many were referred to the │ │ Attorney General. │ ├─◆ FROM the Assistant Attorney General for National Security, on each │ │ referral in the last 365 days plus any still open: date received, │ │ whether substantiated, the highest classification level involved, │ │ whether a criminal investigation is active, whether charges were │ │ filed, and whether the disclosure was attributed to anyone. │ ├─◆ TO the two congressional intelligence committees; the Department's │ │ report also goes to both Judiciary committees. │ └─◆ ☐ The reports "shall be unclassified," with a classified annex │ permitted. ✕ No public release is required and none is routine. │ ◈ Which is why the best figures available to a reader are old ones. │ ──▶ ■ THE FUNNEL, IN THE ONLY NUMBERS ANYONE HAS PUBLISHED ┌────────────────────────┬────────────────────────────────────────────────┬─────────────────┐ │ PERIOD │ WHAT WAS COUNTED │ COUNT │ ├────────────────────────┼────────────────────────────────────────────────┼─────────────────┤ │ Around 2000 │ Leak crimes reports received, per year │ About 50 │ │ │ (Attorney General Janet Reno) │ │ │ Around 2000 │ Investigations the agencies asked for, per │ 20 to 25 │ │ │ year │ │ │ Around 2000 │ Of those, investigations the Department opened │ Almost all │ │ 1995-1998 │ Written crimes reports to the Department, per │ About 200 │ │ │ year, all crimes (CIA Inspector General) │ │ │ Sept 2001 - Feb 2008 │ FBI media-leak investigations opened and │ 85 │ │ │ closed │ │ │ Sept 2001 - Feb 2008 │ Of those, prosecutions │ 0 │ │ Sept 2001 - Feb 2008 │ Still open as of February 2008 │ 21 │ │ 2005-2009 │ Referrals of unauthorized disclosure │ 183 │ │ 2005-2009 │ FBI investigations opened │ 26 │ │ 2005-2009 │ Suspects identified │ 14 │ │ 2005-2009 │ Prosecutions │ Not published │ │ Jan - July 2017 │ People charged (Attorney General Jeff │ 4 │ │ │ Sessions) │ │ │ 2010-2026 │ A government-wide referral-to-prosecution │ Not published │ │ │ ratio │ │ └────────────────────────┴────────────────────────────────────────────────┴─────────────────┘ In the first six months of 2017 the Attorney General said the Department had received "nearly as many criminal referrals" as in the prior three years combined, and had "more than tripled" the number of active leak investigations. Neither statement came with a number. THE READING, SET OUT PLAINLY ══════════════════════════════════════════════════════════════════ Every stage of this process has a document, a deadline or a named official attached to it - except the two stages that decide the outcome. No deadline governs the crimes report. No rule requires the Justice Department to open an investigation, and none requires it to close one. The screen that decides whether anyone looks asks how findable the leaker is, not how much harm was done. And the sanction that actually lands in most cases - the clearance, and the database entry that follows it - requires no charge, no jury and no published reason. ══════════════════════════════════════════════════════════════════ The criminal cases are the ones we can see. They are not the ones that decide what happens to people who leak. ══════════════════════════════════════════════════════════════════ ``` ## Notes **Officeholders and offices (verified October 2026).** The Attorney General, who alone can authorise compulsory process against a journalist under 28 C.F.R. § 50.10, is [[Todd Blanche]], sworn in on 10 August 2026 after a contested confirmation. He succeeded [[Pam Bondi]], who had held the office since February 2025 and who issued the April 2025 memorandum described below. The Director of the [[FBI]], whose agents conduct Tier 3 investigations, is [[Kash Patel]]. The Assistant Attorney General for the National Security Division, who supervises these cases and who carries the statutory semiannual reporting duty, is [[John Eisenberg]]. Three of the offices that appear in the flow — the National Security Division, the National Counterintelligence and Security Center and the Intelligence Community Inspector General — matter here as institutions rather than as individuals, and the chart names none of them by their holder. **The April and May 2025 change to the news-media policy, precisely.** On 24 April 2025 the Attorney General issued a memorandum rescinding the news-media policy adopted under [[Merrick Garland]] in 2021 and 2022, which had barred the use of subpoenas, search warrants and court orders to obtain journalists' records in most leak investigations. The rescission restored the Department's authority to use compulsory process against members of the news media in unauthorized-disclosure cases. The regulation itself was then rewritten: the current text of 28 C.F.R. § 50.10 was published at 90 FR 18786 on 2 May 2025. The surviving architecture is a set of internal approval requirements — Attorney General authorization, advance notice to the journalist in most cases, notice within 45 to 90 days where it is withheld, and copies to the Office of Public Affairs — followed by § 50.10(i), which states that none of it creates an enforceable right. ◈ The practical reading is that the policy constrains subordinates, not the office that writes it. **The eleven questions are not public.** The questionnaire is referenced by name in Intelligence Community Directive 701, which instructs the originating element to answer "the Department of Justice's Traditional 11 Questions" during its preliminary inquiry, and it has been described by former officials and in congressional testimony. The Department has not published the form, and no authoritative public text of the eleven items exists. The chart therefore sets out what the questions are reported to measure rather than purporting to quote them. Anyone who finds the form published will find that it is a shorter document than its influence on these cases suggests. **The January 2026 prosecution.** On 22 January 2026 a federal grand jury in Maryland indicted Aurelio Luis Perez-Lugones, 61, of Laurel, on five counts of unlawfully transmitting and one count of unlawfully retaining classified national defense information under 18 U.S.C. § 793(e). He had been arrested on 8 January and charged by complaint on 9 January. According to the indictment he held a Top Secret clearance, had worked since at least 2002 as a systems engineer and IT specialist for a contractor on intelligence community contracts, and between October 2025 and January 2026 repeatedly accessed classified reports, printed or copied them, removed them from the secure facility where he worked, and passed them to a reporter who was not authorised to receive them. The charges are allegations; he is entitled to the presumption of innocence and the case had not been tried as of the end of October 2026. The case is included here because the evidence the government described is the ordinary kind — a phone, a search, a document in a vehicle — and not a journalist's records. **The October 2026 charge against a former FBI Director.** On 5 October 2026 the Department filed a two-count criminal information under seal against [[James Comey]], unsealed on 26 October 2026, alleging that he communicated information relating to the national defense, and conspired to do so, to a person not entitled to receive it, in connection with a newspaper article published on 5 October 2016. Four features of the filing are structural rather than political, and are why it appears on this page. First, the instrument is a criminal information rather than a grand jury indictment, which the Department has said was done to preserve the charge against a ten-year limitations deadline; Comey's lawyers contend the charge is time-barred and that the extended period cannot be reached by an information. Second, the alleged disclosure is ten years old. Third, two United States Attorney's offices had previously examined the matter and declined to bring charges — the ordinary Stage 4 outcome, reopened. Fourth, the defence asserted is authorization: that the information had been declassified or its release approved. The charges are allegations and had not been tried. Comey states that he is innocent. This is the third federal case brought against him since September 2025; the first was dismissed after a court found the prosecutor who brought it had been unlawfully appointed, and the second remains at the pretrial stage. **Why the published figures stop in the 2000s.** The detailed numbers in the funnel table come from a period when the Department and the intelligence agencies were describing their own volumes in testimony and inspector-general reports. The statutory reporting requirement that now exists, 50 U.S.C. § 3235, was written to produce exactly these figures on a schedule — twice a year, unclassified, with a classified annex permitted — but it delivers them to four congressional committees rather than to the public, and the committees have not routinely released them. ◈ The result is that the system's own disclosure requirement has made the numbers less available than they were when nobody was required to report anything. **On Guideline K and the clearance track.** Guideline K is one of thirteen national security adjudicative guidelines, and it is titled "Handling Protected Information." Its stated concern is that deliberate or negligent failure to comply with rules for protecting classified or other sensitive information raises doubt about an individual's trustworthiness, judgment and reliability. It lists several disqualifying conditions, which fall into two broad kinds: intentional violation of security rules, and repeated carelessness or inattention in following them. Neither requires a criminal charge. The governing standard across all the guidelines is whether access is "clearly consistent with the interests of national security," a formulation that places the burden on the individual and resolves doubt in the government's favour. The mechanics of suspension, notice, reply and appeal are set out on [[How a Security Clearance Is Granted and Revoked]]. **What this page does not resolve.** How many unauthorized-disclosure referrals the Justice Department has received in any year since 2009, which the semiannual reports under § 3235 would answer. How many of those referrals ended at Tier 1, which is the figure that would establish the shape of the funnel for the present day. How often compulsory process against a journalist has in fact been authorised since the April 2025 rescission, which only the Attorney General's office can say. Whether any court has ever held an agency to the notice provisions of § 50.10 — the text of § 50.10(i) suggests the answer is structurally no. And how many leak matters are resolved entirely on the personnel track, which is the question this page argues is the important one and is also the one for which no number exists anywhere. ## See also - [[Espionage Act of 1917]] — the 1917 statute that nearly every one of these prosecutions is brought under, and the reason there is no leak statute - [[How Classified Evidence Reaches a Criminal Trial]] — what the accused is permitted to see and show once a charge is filed, and who decides - [[How Information Is Classified and Declassified]] — the upstream question of how the information became protected in the first place - [[How a Security Clearance Is Granted and Revoked]] — the parallel track in full, including the notice, the reply and the limits of appeal - [[Department of the Navy v. Egan]] — the 1988 decision that put the substance of clearance determinations beyond ordinary judicial review - [[National Security Division]] — the Justice Department component that decides whether a referral becomes an investigation - [[National Counterintelligence and Security Center]] — notified on every crimes report, and the office that reports community-wide - [[Scattered Castles]] — the database where a revoked clearance is recorded, and where it follows the person - [[Graymail]] — the defence leverage that comes from a prosecution's need to confirm sensitive material in open court - [[Classified Information Procedures Act]] — the 1980 procedure that governs classified evidence in a criminal case - [[Information Security Oversight Office]] — where classification violations are reported, separately from any criminal referral - [[Executive Order 12333]] — the order whose § 1.6(b) creates the intelligence community's duty to report suspected crimes - [[Intelligence Community Whistleblower Protection Act]] — the lawful channel that exists alongside the unlawful one - [[Inspector General Act of 1978]] — the inspectors general who are notified, and who can investigate without the eleven-question screen - [[Freedom of Information Act]] — the route a stranger can use, and the one that reaches none of this - [[Pentagon Papers]] — the case that established how little a prior restraint can do, and how much a prosecution can - [[Grand Jury]] · [[Prosecutorial Discretion]] · [[Attorney General]] · [[Department of Justice]] · [[FBI]] · [[ODNI]] - [[James Comey]] · [[Todd Blanche]] · [[Pam Bondi]] · [[Kash Patel]] · [[John Eisenberg]] · [[Merrick Garland]] - [[Chelsea Manning]] · [[Edward Snowden]] · [[Julian Assange]] · [[New York Times]] · [[Washington Post]] - [[Judiciary Hub]] · [[Federal Agencies Hub]] · [[Foundations Hub]]