Or 2. Do comprehensive physical and electronic surveillance for say 24-72 hours to see if they try to get in contact with foreign nationals, and investigate whether they have a "dead man's switch" to release more documents?
Option 2 makes more sense to me. When cleaning this situation up it will be essential to know what he leaked and who he leaked it to. Unfortunately the NYT and Bellingcat may have forced law enforcement to move prematurely. That or friendly media got a tipoff to establish the desired narrative while the government does the "no comment during an active investigation" line.
1. Swoop in and arrest them immediately
Or 2. Do comprehensive physical and electronic surveillance for say 24-72 hours to see if they try to get in contact with foreign nationals, and investigate whether they have a "dead man's switch" to release more documents?
Option 2 makes more sense to me. When cleaning this situation up it will be essential to know what he leaked and who he leaked it to. Unfortunately the NYT and Bellingcat may have forced law enforcement to move prematurely. That or friendly media got a tipoff to establish the desired narrative while the government does the "no comment during an active investigation" line.