Newly released memos revealing that Air Force leadership repeatedly warned Airman 1st Class Jack Teixeira about inappropriately accessing classified intelligence have left former and current defense personnel baffled at how he retained his security clearance and was able to continue sharing classified information for months.
"This is negligence on the part of the chain of command," said Jason Kikta, a former Marine Corp Officer and former member of US Cyber Command. "They had a clear pattern of behavior," adding he "should have been cut off at the second incident."
Three Air Force memos documenting Teixeira's misconduct were released publicly on Wednesday as part of the prosecution's argument in favor keeping him detained pending trial.
The memos showed that Teixeira, a 21-year-old junior enlisted airman who worked within the Massachusetts Air National Guard's 102nd Intelligence Wing, had received a direct order from his superiors to stop taking notes on intelligence, which they found he was ignoring just a month later. And just months before he was arrested for allegedly sharing the intelligence online, a third memo said a supervisor observed him accessing intelligence unrelated to his job.
Teixeira was arrested on April 14 and has been charged under the Espionage Act with unauthorized retention and transmission of national defense information and unauthorized removal of classified information and defense materials.
Teixeira has not yet entered a formal plea, and a detention hearing is scheduled for Friday. His defense lawyers have argued he didn't expect classified information that he posted on Discord to be further spread around the internet.
Virginia Democratic Sen. Mark Warner, chairman of the Senate Intelligence Committee, told CNN on Thursday that the new information was "deeply troubling."
"You can bet the Senate Intelligence Committee will be following up on it," he said.
According to one current US service member who handles classified intelligence, the memos read as if Teixeira's leadership was building a case for disciplinary action against him. It's unclear, however, where those memos went or who saw them.
'Observed taking notes'
A memo from September 2022 says Teixeira was "observed taking notes on classified intelligence information" in the unit's sensitive compartmented information facility, or SCIF, and putting "the note into his pocket." He was instructed "to no longer take notes in any form on classified intelligence information," the memo said.
A month later, his supervisors believed he was "potentially ignoring" a cease-and-desist order he was given in September, to stop deep diving into intelligence.
They were made aware of the second infraction when Teixeira started asking "very specific questions" after a weekly intelligence briefing, and was asked if he had been accessing JWICS, a government network for top secret information, to look up classified intelligence.
The current US service member said that typically would have been an immediate red flag to everyone in the room, given that not only had Teixeira been told not to take notes on classified intelligence, but that his job as a cyber systems journeyman wouldn't require him to know that information.
"If one of our cyber troops showed up at a briefing and started asking detailed questions, everyone in the room is going to be like ... What in the world are you doing?'" the service member said. "That is so outside the norm."
Some understanding, though, could be gleamed by an offer to Teixeira that was recorded in the second memo to train into a different job that would have provided him more access to intelligence.
The memo says that Teixeira was "offered an opportunity to explore cross training into 1N0 or 1N4 [Air Force Specialty Codes]," but declined, meaning that Teixeira's leadership offered to help him get a new job in Air Force intelligence. Jobs under the 1N0 and 1N4 job codes would have given him more hands-on responsibilities with intelligence, the current service member and a former enlisted intelligence airman told CNN.
Both the current and former service members said that the offer from his leadership suggests they may have had the mistaken belief that his persistent interest in intelligence was a sign that he was being underutilized in his current role and wanted to help him find a job that was a better fit.
But the current service member added, the fact that the offer for a different job came a month after they'd already given him a direct order not to take notes on classified intelligence -- an order they had reason to believe he was ignoring -- is a significant concern.
The third instance occurred in January 2023, just months before Teixeira was arrested for allegedly posting information to Discord, a popular social media platform among gamers. The third memo said that on January 30, a senior non-commisioned officer was walking the operations floor when she spotted Teixeira "on a JWICS machine" and "viewing content that was not related to his primary duty and was related to the intelligence field."
The memo said only that the senior NCO notified their leader of her observation. There was no mention of additional discussions with Teixeira regarding what she observed.
Air Force investigation is taking place
What did or did not happen following Teixeira's actions and the concerns from his supervisors will be part of the Air Force's own investigation of the unit, which is ongoing.
One current defense official said the memos, written by his enlisted supervisors, should have been seen by his commander. But the current service member said it would not be unusual for senior non-commissioned officers to handle disciplinary matters with a junior enlisted airman like Teixeira.
Either way, the official said the commanders' awareness, or lack thereof, of the memos by Teixeira's enlisted leadership could have been the reason two leaders from the unit were suspended following his arrest.
A 2016 directive from the Office of the Director of National Intelligence (ODNI) -- part of an effort to beef up security after multiple high-profile intelligence leaks -- requires security clearance holders to report concerning activity from colleagues, including misuse of government computers and an unwillingness to follow security protocols.
All of Teixeira's behavior as described by prosecutors was reportable under that ODNI directive, according to Carrie Wibben, who helped write the policy when she was an ODNI official.
"Every person in his chain of command likely also has a security clearance, at least at a secret level," Wibben, now an executive at consulting firm Exiger, told CNN. "As clearance holders, they are also in violation of security policy if they decided not to report those incidents to the appropriate personnel security official assigned to their unit or higher-level command."
Ultimately, the service member said the non-commissioned officers writing the memos regarding Teixeira's behavior should have gone directly to the special security officer (SSO), a position that exists within every SCIF which has the authority to suspend a service member's access to classified information.
Both the current service member and a former enlisted intelligence airman gave examples from their own experiences in SCIFs where a security officer has taken action for various concerns that could impact a service member's clearance, such as a DUI over the weekend, or mounting financial debt in someone's personal life.
"If I'm a section team lead, which is what these NCOs were, and I know that one of my troops is doing this, I am raising it with proper authorities because I do not want the buck to stop with me," the service member said. "The moment I saw the first thing of taking notes on classified material, I would have already gone to a security officer."
A second former senior Defense Department official told CNN that it was bizarre Teixeira's leadership spoke to him twice about his actions but did not appear to restrict his access to intelligence.
Kikta, the former Marine Corps officer, echoed a similar sentiment.
"By the third [incident], we're in negligence land," said Kikta, who is now an executive at security firm Automox. "At that point, Teixeira's not the problem. You are."