J. William Leonard (Photo: House Committee on Oversight & Government Reform via Flickr)

Attorneys for a U.S. Air Force veteran accused of leaking classified information about Russian hacks targeting state election boards have signaled they will challenge whether the document in question truly contained classified national defense information.

Reality Winner’s defense this week notified federal prosecutors they intend to call J. William Leonard—the U.S. government’s former “classification czar”—as an expert witness at a trial scheduled to begin in October. Leonard served as director of the U.S. Information Security Oversight Office from 2002-2008.

Leonard is expected to testify about whether the document Winner is accused of leaking to online news publication The Intercept was actually closely held, according to her defense. The team is led by Baker Donelson partner Joe Whitley, former general counsel for the Department of Homeland Security.

Leonard also will be asked to testify as to whether there was any potential harm associated with the alleged leak, the defense notice said.

Winner, who was working for a National Security Agency contractor in Augusta when she was arrested, on June 3 will have spent one year in jail. She repeatedly has been denied bail by U.S. Magistrate Judge Brian Epps and U.S. District Chief Judge Randal Hall after the government branded her a national security risk.

The Trump administration has identified Winner as its first prosecution linked to a media leak. The Justice Department has charged Winner under the federal espionage statute, which is intended to prevent military secrets from being stolen for enemies of the United States.

Integral to the espionage charge Winner faces is whether the document in question includes designated “national defense information.” In a February ruling, Hall specified that such information includes “matters that directly or may reasonably be connected with the defense of the United States against its enemies.”

Hall said prosecutors must prove disclosure would potentially damage national defense or be useful to a foreign enemy in order to convict. The government must also prove the document was “closely held” and not available to the general public.

Justice Department attorneys with the National Security Division, assisted by U.S. Attorney Bobby Christine of the Southern District of Georgia, have used the espionage charge and claims that the document constituted national defense information to convene secret hearings, seal court pleadings and restrict Winner’s defense on where and how they may review or talk about information related to her defense without prior approval of a government classification officer.

The “national defense” designation also requires that anyone associated with Winner’s defense hold a government security clearance.

Leonard’s testimony also will include a review of information culled from public sources, including reports, workpapers, bulletins, news articles and other publicly available information, according to the defense notice. He’s also likely to address whether the document Winner is accused of leaking contained information that was “closely held.”

Leonard spent 35 years in government, many of them assigned to the Defense Department, where he directed or had oversight of multiple government security programs.

He is currently the chief operating officer of the National Foundation for Democracy, which is dedicated to protecting computer networks against advanced and persistent hacks associated with cyberwarfare.

Leonard was responsible for declassifying information that was wrongly classified during George W. Bush’s administration. His rulings could only be reversed by an appeal to the president.

The document Winner is accused of leaking included specifics on attempts by Russian intelligence operatives in the run-up to the 2016 presidential election to hack state election systems through a voter registration-themed spear-phishing campaign, according to The Intercept, which published a story based on the leaked document two days after Winner’s arrest.

According to The Intercept, which also published a redacted version of the document, it provided specifics on how hackers attempted to infiltrate election systems by posing as an electronic voting vendor.

In August 2016—10 months before Winner’s arrest—the FBI sent a flash alert containing information similar to that in the document Winner is accused of leaking that warned states to be on the lookout for hackers targeting their election systems, according to a “60 Minutes” report.

Three weeks after Winner was arrested, the Homeland Security’s acting director of the Office of Intelligence and Analysis Cyber Division testified before the Senate Intelligence Committee about Russian hackers’ efforts to interfere with the 2016 presidential election and their success in penetrating some networks associated with state election systems, according to The Washington Post.

Three months after Winner’s arrest, Homeland Security belatedly notified 21 states that their election systems had been targeted in 2016 by suspected Russian hackers, according to The New York Times.

The defense has appealed to Hall to reverse Epps’ April 28 ruling—made at the government’s request—to stop them from issuing 40 subpoenas, including to the 21 states  notified that their election systems had been targeted  by Russian hackers.

Epps has already qualified Leonard as an expert in national defense information, and heard him testify at a secret hearing in April.

Leonard’s testimony could be key to Winner’s defense. In February, Hall, the trial judge, ruled that government documents marked for official use only “might provide the defendant with evidence that the NDI [national defense information] she allegedly leaked was neither closely held nor potentially damaging.”

That could include the allegedly leaked document. The redacted version published by The Intercept includes identification tags for unclassified, official use only and top secret.