Originally Published: 11 APR 23 12:05 ET

By Natasha Bertrand, Zachary Cohen, Kylie Atwood, Alex Marquardt and Haley Britzky, CNN

(CNN) -- The US government investigations into a leak of highly classified Pentagon documents are starting to take shape, with the Pentagon examining how the leak impacts US national security and the Justice Department launching a criminal investigation into who may have been behind the breach.

The interagency probe is being led by the Pentagon's Office of Intelligence and Security, according to three US officials, and could take months to complete. It will chiefly examine whether any sources and methods have been compromised since the documents, many of which are marked Top Secret, were posted on a social media platform earlier this year.

Milancy Harris, the deputy under secretary of defense for intelligence and security, will be in charge of the effort on the Pentagon side, officials said. The investigation will also try to determine the scope of the leak, since officials do not yet know whether it has been contained or whether there are more classified documents still circulating online.

The Pentagon effort is not focused on the source of the leak, one senior Pentagon official said. But the Defense Department will be examining how it distributes highly classified information and whether it needs to change who receives it on a daily basis.

"Way too many people have access to very sensitive information," a senior US official told CNN, noting that "thousands" of people likely saw these documents before they hit the internet.

Different batches of documents have appeared online in stages, some posted over a month ago but only coming to light widely late last week. As of now, senior defense officials have little idea who may have been behind the leak. Some have speculated in recent days that it could have been a Pentagon official's child wanting to show off to his friends on Discord, a social media and gaming platform where the documents first appeared earlier this year.

But that still wouldn't explain why the documents were removed from the Pentagon in the first place, officials said. The leaked materials appear to be photos of documents that were crumpled up and wrinkled, as though they had been folded and stuffed in a pocket.

While many officials tend to take classified information home, one senior US official said, the fact that the paper was folded up "tells me this person did not have that authority."

"We're still investigating how this happened, as well as the scope of the issue," assistant to the Secretary of Defense for public affairs, Chris Meagher, told reporters on Monday. "There have been steps to take a closer look at how this type of information is distributed and to whom. We're also still trying to assess what might be out there."

"It's embarrassing"

Pentagon officials have been warned that anything they say about the situation could be used as part of the criminal investigation, officials said, so officials are being extremely careful with how they describe the leaked documents.

Still, officials familiar with the situation tell CNN the documents appear to be part of a daily intelligence briefing deck prepared for the Pentagon's senior leaders, including Chairman of the Joint Chiefs of Staff Mark Milley.

On any given day, the slides in that deck can be properly accessed by hundreds, if not thousands, of people across the government, officials said.

"It's embarrassing," a senior defense official said, adding that there have been stern notes from the Defense Department's White House Liaison Office to be more careful about social media and keeping track of classified material.

A version of the daily update is also published to a classified site that can be accessed by people with the proper clearance. That access is recorded, officials said, but downloading the slides themselves is not necessarily suspicious.

The senior US official added that "any office where there's a boss" has a Microsoft version of a tablet that has been decommissioned. That tablet includes Top Secret and Sensitive Compartmented Information, including the Joint Staff Chairman's daily intelligence summary and intelligence that informs the presidential daily brief, the official said.

Tracking the printers

In addition to the tablets, Pentagon officials will be given binders of printed out intelligence daily, said two senior US officials.

Parts of the daily update can also be emailed and are often auto-forwarded to individuals on specific distribution lists, officials said. The Joint Staff, which comprises the Defense Department's most senior uniformed leadership that advises the president, is examining its distribution lists to look at who gets these reports, a defense official said. Many of the documents had markings indicating that they had been produced by the Joint Staff's intelligence arm, known as J2.

Investigators will undoubtedly be examining printer logs from the last several months, officials said, which could potentially limit the pool of suspects.

"You can print Top Secret documents but only to a printer that is networked to Top Secret computers," one of the senior US officials said. Each printer has a unique identifier and everything printed is traceable, another senior Pentagon official said.

The photos of the printed documents that appeared online will also be closely scrutinized for any markings that could identify the printer from which they were printed, another US official said.

Fallout with allies

Deputy Secretary of State Wendy Sherman has been tapped to lead the diplomatic response to the leaked US intelligence documents, according to a US official familiar with the matter.

Some of the leaked documents have exposed the extent of US eavesdropping on key allies, including South Korea, Israel and Ukraine.

South Korean officials have publicly responded angrily to the leaked documents, which describe, in remarkable detail, a conversation between two senior South Korean national security officials about concerns by the country's National Security Council over a US request for ammunition.

Defense Secretary Lloyd Austin and South Korea's Defense Minister Lee Jong-sup spoke on Monday evening, eastern time, according to a Pentagon official and a readout from South Korea's presidential office. The South Koreans said that the two defense leaders agreed that a "considerable amount" of information in the leaked Pentagon documents are "fabricated."

Neither the Pentagon nor the South Korean presidential office responded to CNN's request for more details. Meagher said on Monday that "some of these images appear to have been altered."

As CNN has previously reported, one leaked document listing Russian and Ukrainian casualty numbers as part of the war in Ukraine was altered in recent weeks to more than halve the number of Russian deaths before being spread on pro-Russian Telegram channels.

Officials from the countries in the Five Eyes intelligence-sharing partnership with the US -- Australia, New Zealand, the UK, and Canada -- have not yet gotten a briefing from the US on either a damage assessment or progress in identifying the leaker, two Five Eyes diplomats told CNN on Monday.

One of the diplomats said they expect a briefing from US officials in the coming days and noted that the Easter holiday has slowed the pace of discussions.

'Bad outcomes on the battlefield'

US lawmakers are also looking for answers. The Pentagon has notified the relevant congressional committees of their probe, including the Senate Intelligence and Senate Armed Services committees, sources said.

A spokesperson for the Senate Armed Services Committee said in a statement that "Chairman Reed is tracking this issue closely. The Department of Defense and other agencies have launched investigations, and the Senate Armed Service Committee expects to be fully briefed on the Pentagon's investigation as it proceeds."

Rep. Jim Himes, the top Democrat on the House Intelligence Committee, told CNN on Monday that "anything that points to sources and methods carries the very real risk that those sources and methods go away. And that can mean people being killed, that can mean technologies being shut down. And that translates into bad outcomes on the battlefield."

"We do need the public and our allies, in particular, to know what changes are being made to avoid this ever happening again," he added.