Officials initially suggested the NSA contractor accused of stealing piles of state secrets, dubbed the "second Snowden," may have simply kept the files for himself. Now, they might be changing their tune. Investigators say there are "forensic clues" that Harold Thomas Martin III is the source of the NSA hacking tools put up for auction online by the anonymous Shadow Brokers group. The tools—essentially computer codes, plus instructions— were among the files Martin allegedly stole, though investigators don't know whether he leaked or sold them or whether someone (perhaps a hacker) stole them from him, reports the New York Times. Authorities have not conclusively linked him to the Shadow Brokers.
Officials turned their eyes to Martin—who once held a support role with the NSA's top hacking unit, per the Washington Post—based on something he'd posted online, though it isn't clear what that was. Thousands of pages of documents and "many terabytes" of data were then discovered in his home, car, and shed during an Aug. 27 raid, investigators say, making this "by far the largest unauthorized leak of classified material from the classified sector," per the Times. Martin allegedly says he took the files home so he could study them and become better at his job—people who know him say he's patriotic and would never leak secrets—but investigators aren't convinced.