The FBI used billing records from an internet social media app to unmask US airman Jack Teixeira as a suspect over the leak of top-secret military documents, court documents showed.
The leak is believed to have started on the Discord chat platform, frequently used by people who play online games.
Discord said it was cooperating with the bureau, according to an FBI affidavit unsealed on Friday.
He was arrested on Thursday by heavily armed tactical agents after a week-long investigation into the disclosure of the highly sensitive government records.
The 21-year-old appeared before a federal magistrate judge at a court in Boston on Friday, charged with possessing unclassified documents pertaining to national security and possessing national defense materials.
Defence Secretary Lloyd Austin, in a statement issued after the arrest, said the Pentagon would conduct a review of its “intelligence access, accountability and control procedures” to prevent such a leak from happening again.
President Joe Biden said he has “instructed the Department [of Defence] to make sure that they get to the root of why” the suspect had access to the documents and “to focus extensively on the extent to which it all occurred”.