BOSTON >> Billing records of an Internet social media platform and interviews with another user helped the FBI identify a Massachusetts Air National Guardsman as a suspect in the leak of highly classified military documents, according to court records unsealed today.

The new details came as Jack Teixeira, 21, appeared in court to face charges under the Espionage Act of unauthorized removal and retention of classified and national defense information.

A federal magistrate judge ordered him held until a detention hearing next week.

Teixeira was arrested by heavily armed tactical agents on Thursday following a weeklong criminal investigation into the disclosure of the government records, a breach that exposed to the world unvarnished secret assessments on the war in Ukraine, the capabilities and geopolitical interests of other nations and other national security issues.

He appeared in court today in tan jail clothes for a brief proceeding at which U.S. Magistrate Judge David Hennessy ordered him held pending a hearing next Wednesday.

Investigators believe Teixeira was the leader of an online private chat group on Discord, a social media platform popular with people playing online games.

Billing records the FBI obtained from Discord, which has said it was cooperating with the bureau, helped lead investigators to Teixeira, according to an FBI affidavit unsealed today.

According to the document, the FBI interviewed someone familiar with Teixeira’s online posts on Monday. That person, who is not identified in the affidavit, told the FBI that a username linked to Teixeira began posting what appeared to be classified information roughly in December.

The affidavit suggests Teixeira switched from typing out documents in his possession to taking them home and photographing them because he “had become concerned that he may be discovered making the transcriptions of text in the workplace.”

That’s different from what posters have told The Associated Press and other media outlets, saying the user they would call “the O.G.” started posting images of documents because he was annoyed other users weren’t taking him seriously.

The affidavit also alleges Teixeira was detected on April 6 — the day The New York Times first published a story about the breach of documents — searching for the word “leak” in a classified system. The FBI says that was reason to believe Teixeira was trying to find information about the investigation into who was responsible for the leaks.

The Biden administration has scrambled to contain the potential diplomatic and military fallout from the leaks since they were first reported, moving to reassure allies and assess the scope of damage.

The classified documents — which have not been individually authenticated in public by U.S. officials — range from briefing slides mapping out Ukrainian military positions to assessments of international support for Ukraine and other sensitive topics, including under what circumstances Russian President Vladimir Putin might use nuclear weapons.

In previous Associated Press stories, the leaker was identified as “the O.G.” by a member of the online chat group. Known as Thug Shaker Central, the group drew roughly two dozen enthusiasts who talked about their favorite types of guns and also shared memes and jokes. The group also held a running discussion on wars that included talk of Russia’s invasion of Ukraine.

In that discussion, “the O.G.” would for months post material that he said was classified — originally typing it out with his own notations, then a few months ago switching to posting images of folded-up papers.

It was not immediately clear how Teixeira would have had access to the records, but a Defense Department official told the AP on Thursday that as an information technology specialist responsible for military communications networks, the young Guardsman would have had a higher level of security clearance

Defense Secretary Lloyd Austin, in a statement issued after the arrest, said the Pentagon would conduct a review of its “intelligence access, accountability and control procedures” to prevent such a leak from happening again.