Daniel sent us this one — and it lands right in the middle of something that broke just this week. Trump confirmed to reporters on Air Force One that he did call Netanyahu "crazy" on a call, enraged by the war in Lebanon. The confirmation came after Axios ran the story, attributed to sources familiar with the call. And the question isn't really whether Trump said it — he says he did. The question is how we know he said it. Who was in the room? How many people could have told Axios? And when a leak like this happens, is it a breach or is it a briefing?
This is exactly the kind of puzzle that rewards going below the surface. Because most coverage treats the "crazy" quote as the story. But the real story is the plumbing. Twelve to eighteen people on a bilateral call, a tiny suspect pool, and yet someone talked. Either someone took a career-ending risk, or someone was told to talk. Both are plausible, and that ambiguity is the whole game.
Let's unpack what actually happened, and why the confirmation doesn't settle the question.
So the timeline: June second, Trump is on Air Force One, does a press gaggle, and confirms the Axios story. The Axios piece, by Barak Ravid, ran a day or two earlier — attributed to, quote, "sources familiar with the call." Trump's confirmation was characteristically direct. He didn't dispute the quote. He owned it. Said Netanyahu was pursuing a course in Lebanon that was, in his view, crazy.
Which is, structurally, a fascinating move. If the leak was unauthorized and designed to embarrass him, confirming it is the last thing you'd do. You'd deny, you'd investigate, you'd fume about leakers. Instead he said, yeah, I said that. Which immediately changes the calculus on whose leak this was.
That's what we want to dissect. Not the politics of the remark, but the information architecture around it. To do that, we need to answer three things. First, who is physically on a call like this? Second, how do leaks actually happen — what are the mechanics? And third, how can an outsider tell the difference between a real leak and a planted one?
To the first question. Who was in the room — and I mean literally, who was sitting where?
Let me map this out. A bilateral call between the president of the United States and the prime minister of Israel is not two people on a line. It's a production. On the US side, you've got the president, a State Department diplomatic interpreter — these are career professionals, not political appointees — the NSC director for Israel and Palestinian affairs, the White House chief of staff, the national security advisor, the secretary of state, the US ambassador to Israel, and a Situation Room duty officer whose job is to produce the verbatim transcript. That's eight people minimum on the American side.
On the Israeli side?
The prime minister, his military secretary, a translator — usually from the prime minister's office, not the foreign ministry — the national security advisor, the Mossad director often sits in if the call touches on regional security, which this one certainly did, plus the Israeli ambassador to the US and a note-taker. That's another six to eight. Total, you're looking at twelve to eighteen people.
This isn't speculation. Fiona Hill, who was the NSC senior director for Russia under Trump, testified about exactly this setup. She described the call architecture in detail during the first impeachment proceedings. Twelve to eighteen people is the standard complement.
There's a reason for that number. It's not bloat. Each person has a function. The interpreter is there because nuance matters — you don't want the president paraphrasing what he thinks he heard. The NSC director is there because they own the policy portfolio and need to action items immediately. The chief of staff is there to manage follow-through on the president's commitments. The Situation Room officer is there to produce a record that goes into the classified archive. Nobody is in that room as a spectator.
Which brings us to the physical and technical security around the call — what people in the intelligence community call the cone of silence.
The cone of silence is not a metaphor. A presidential call with a foreign leader happens in a SCIF — a Sensitive Compartmented Information Facility. The Situation Room is a SCIF. The president might take the call from the Oval Office, which is also a SCIF when properly configured, or from the residence, which has a secure communications suite. The point is, the room is hardened.
TEMPEST shielding — that's the technical standard for blocking electromagnetic emissions. No personal devices. Phones are left outside. Signal-jamming is active to prevent any unauthorized transmission. The call itself runs over encrypted lines, and the recording equipment in the Situation Room is air-gapped from unclassified networks. The transcript that comes out is classified Top Secret slash SCI by default. It's not just a memo. It's a controlled document with handling restrictions.
The idea that someone in the room is surreptitiously recording on their phone is essentially impossible.
Not just essentially. If you tried, you'd be caught. The security protocols assume insider threat. The people in that room have been through background checks that took months. They know the penalties. Unauthorized disclosure of classified information is a felony with a potential ten-year sentence per count. And this isn't abstract — people have gone to prison for less.
The pool of possible leakers, if the leak came from the call itself, is twelve to eighteen people. But that's not the whole story, is it?
No, and this is where most coverage gets it wrong. The pool isn't just the people in the room. Every person in that room has staff. The NSC director has deputies who need to know what was decided so they can draft follow-up cables. The chief of staff has assistants who schedule the next calls. The ambassador has a political team back at the embassy who need the readout. And those people talk to their spouses, their drivers, their gym partners.
The classic Washington leak vector — the staffer who overheard the debrief in the car.
And let me give you a concrete example. The twenty seventeen Trump-Turnbull call — the one with the Australian prime minister. That call had seventeen people on it, and the leak to the Washington Post traced back to a White House staffer who wasn't on the call but was in a debrief afterward. The staffer was fired. But the point is, the suspect pool wasn't seventeen. It was seventeen plus everyone those seventeen talked to in the next six hours. That's easily fifty or sixty people.
That's before we even get to the Israeli side, which has its own debrief chain, its own staffers, its own political dynamics.
And the Israeli security apparatus is famously porous in a very specific way. Israeli officials leak to Israeli journalists constantly. It's practically a governance tool. The difference is, Israeli journalists operate under military censorship laws — they can't publish certain things without clearance. But political leaks? Those flow freely. So you've got an Israeli chain of debrief that could easily be the source.
When we say the suspect pool is small, we mean relative to, say, a congressional briefing where two hundred staffers get the readout. But it's still dozens of people, not dozens of people who were in the room.
And that distinction matters because it changes how an internal investigation works. If the pool is twelve, you polygraph twelve people and you've got your leaker in a week. If the pool is sixty, and half of them are political appointees who might have been told to leak, the investigation gets complicated fast.
Which brings us to the concept that I think is the real heart of this — the authorized leak. The leak that isn't a leak at all, but a delivery mechanism.
This is where we need to be precise about terms. An authorized leak is not a contradiction. It's when a principal — the president, the national security advisor, the secretary of state — wants information in the public domain but doesn't want to say it on the record. So they signal to a trusted aide: this should be out there. The aide calls a reporter. The story runs with attribution to "a senior administration official" or "a source familiar with the call." The principal then either stays silent or issues a non-denial denial. The information is out, the principal's hands are clean, and the reporter got the scoop.
This is not a fringe practice. This is how Washington works.
It's how every capital works. The formal term in political science is "strategic information disclosure." It's been studied extensively. The RAND Corporation did a whole project on it in the early two thousands, looking at how administrations use leaks to shape foreign policy outcomes. Sometimes the goal is to signal resolve to an adversary without issuing a formal threat. Sometimes it's to test public reaction before committing to a policy. Sometimes it's to undermine a rival within the administration.
The Henry Kissinger playbook, essentially.
Kissinger perfected it, but it predates him. FDR used leaks to build public support for lend-lease before Congress was on board. Kennedy used them during the Cuban Missile Crisis to signal to Khrushchev through the press. The authorized leak is a tool of statecraft.
If we apply this to the Trump-Netanyahu "crazy" leak, what do we see?
Let's run through the indicators. First, the leak appeared in Axios. Axios was founded in twenty sixteen with a model of what they call "smart brevity" — short, direct, designed for the attention economy. But more relevant here, Axios has cultivated a reputation for being White House-friendly. Under both the Biden and Trump administrations, Axios has had access that other outlets don't. Barak Ravid, the reporter on this story, is particularly well-sourced on Israel-US relations. He's not a generalist who got lucky. He's the guy you call if you want a story about US-Israel dynamics to land credibly.
The outlet choice is telling. Friendly outlet, specialist reporter.
Second indicator: the attribution. "Sources familiar with the call." That's the classic authorized-leak construction. It's plural — "sources" — which diffuses accountability. It's "familiar with" rather than "on," which expands the pool and makes it harder to investigate. And it's vague enough that nobody can say definitively who talked.
Whereas a real leak, a genuine breach, often has different language. "A person on the call" or "a participant in the meeting.
But "sources familiar" is the safe harbor for authorized leaks. Third indicator: the content. The leak portrays Trump as strong, direct, and unafraid to confront an ally. It shows him pushing back on a war he thinks is ill-advised. That's a favorable portrayal. It's not a leak that makes him look corrupt or compromised. It makes him look like a truth-teller.
Fourth, the confirmation. He didn't deny it. He didn't say he was misquoted. He said yeah, I called him crazy. Which turns a potential scandal into a display of authenticity.
The "plausible deniability" architecture here is elegant, in an information-operations sense. By confirming the leak, Trump neutralizes it as an attack vector. You can't use the leak against him if he owns it. And he gets to send a message to Netanyahu — I said this, I meant it, and now the whole world knows — without having to issue a formal diplomatic communiqué that would create a paper trail and trigger a formal Israeli response.
It's diplomacy by leak, with the confirmation serving as the exclamation point.
This is not the first time. The twenty seventeen leak about Trump telling Comey he hoped he could let the Flynn investigation go — that was an authorized leak from Trump himself, channeled through surrogates. He later confirmed the substance. The twenty twenty Trump-Ukraine call transcript release was a controlled disclosure — the White House released the transcript itself, which is the ultimate authorized leak. The playbook is consistent.
If the authorized leak is one category, what are the others? How do we taxonomize this?
I think there are four basic types. Type one: authorized slash strategic. Principal wants it out, uses a cutout, maintains deniability. Type two: rogue slash ideological. A staffer disagrees with the policy and leaks to sabotage it or expose what they see as wrongdoing. This is the whistleblower model, though not all rogue leakers are whistleblowers — some are just settling scores.
Type three: accidental. Loose talk in an unsecured setting. The classic is the staffer on the Acela talking too loudly on the phone, or the official at a Georgetown dinner party who's had one drink too many.
Type four: foreign intelligence. An adversary intercepts the communication and feeds it to the press to sow discord or embarrass the US. This is rarer but real. The Russians have done this. The Iranians have done this. In twenty twenty-three, a tranche of classified documents appeared on a pro-Russian Telegram channel that US intelligence later assessed came from a signals intercept, not a human source.
How do you tell them apart from the outside?
This is the practical question. And I think there's a framework. Let me walk through it. For an authorized leak, you look for four tells. One: the leak benefits the leaker's political position. Two: the attribution is to "sources familiar" rather than "a person on the call." Three: the leak appears in a friendly outlet first. Four: the denial, if there is one, is a non-denial denial — "I don't recall that," "I have no recollection," "that doesn't sound like something I would say.
The non-denial denial is a whole art form.
It really is. We covered it in depth back in episode one forty-seven, but the short version is: a non-denial denial denies the process or the recollection rather than the substance. "I don't recall saying that" is not "I didn't say that." It leaves the factual claim intact while providing a shield against accountability. When you see a non-denial denial in response to a leak, your authorized-leak radar should be pinging.
For a real leak — a genuine breach — what are the tells?
One: the leak damages the leaker's interests. If the information makes the president look bad, weak, or compromised, it's probably not authorized by the president. Two: the leak includes specific, verifiable details that wouldn't be chosen for narrative effect — exact quotes, timestamps, who reacted how. Narrative leaks are smooth; real leaks are lumpy. Three: the leak triggers an actual investigation — the FBI gets involved, the inspector general opens a case, people are interviewed under oath. Four: the leak is followed by personnel changes. Someone gets fired, someone resigns, someone's clearance is pulled.
Let's apply that to a couple of case studies. The Dobbs leak in twenty twenty-two — the draft Supreme Court opinion overturning Roe.
Classic real leak. It damaged the leaker's side — the conservative justices were furious, their deliberative process was exposed, and the chief justice called it a betrayal of the court's confidentiality. It triggered an investigation by the marshal of the court. It included a specific, verifiable document — the full draft opinion, not a summary. And the leaker, to this day, has not been identified, which tells you how seriously the investigation was taken. Every indicator points to unauthorized.
Contrast that with the twenty twenty-three Pentagon documents leak — the Discord leaks.
Jack Teixeira, a twenty-one-year-old Air National Guardsman with a Top Secret SCI clearance. He was posting classified documents on a Discord server to impress his online friends. That's a real leak. It damaged US intelligence — sources and methods were exposed, allies were embarrassed, the Ukrainians had to change their operational plans. It triggered an FBI investigation and Teixeira was arrested. And the documents were granular — satellite imagery, troop movements, specific assessments. Not narrative-shaped at all. Lumpy in the extreme.
What's striking about the Teixeira case is how low-ranking he was. A twenty-one-year-old airman had access to TS SCI materials. The clearance system is vast.
About four million Americans hold security clearances. One point three million hold Top Secret. The pool of people who can leak classified information is not small. It's enormous. The compartmentalization — the SCI part — is supposed to limit access to specific topics, but in practice, the system is porous. Teixeira had access to documents about Ukraine that had nothing to do with his job as an IT specialist. He was supposed to manage the network, not read the intelligence.
Which is a whole separate conversation about over-classification and access creep. But for our purposes, the point is that a real leak often comes from someone you wouldn't expect, with access you didn't know they had.
The authorized leak comes from someone you would expect, doing exactly what they were told to do.
Let's circle back to the Trump-Netanyahu leak and run it through the framework.
He gets to project strength, independence, and a willingness to confront an ally. He distances himself from a war in Lebanon that is controversial internationally. He signals to the Arab world that he's not in Netanyahu's pocket. And he does it all without issuing a formal statement that would require diplomatic cleanup.
What about Netanyahu? Does he benefit?
It's mixed. On one hand, being called crazy by the American president is not a great look. On the other hand, it reinforces his domestic narrative that he's willing to stand up to pressure, even from allies. Netanyahu has been in politics for decades. He knows how to use a slight to his advantage. "The Americans are pressuring me" is a fundraising tool in Israeli politics.
The benefit analysis doesn't rule out either side as the source.
But the other indicators point toward the US side. The outlet — Axios, Barak Ravid — is a US publication with a US reporter. If the Israelis wanted to leak this, they'd more likely go to an Israeli outlet first, or to the New York Times or Washington Post for maximum impact. Axios is a very specific choice. And the framing — "Trump enraged, calls Netanyahu crazy" — centers Trump's emotional state. That's a US-source framing.
The specificity test. How lumpy is this leak?
We have a specific quote — "crazy" — attributed to Trump. We have a specific context — the war in Lebanon. But we don't have a transcript. We don't have timestamps. We don't have the back-and-forth. It's been shaped for narrative. That tilts toward authorized.
The denial pattern?
That's the strongest signal of all. An unauthorized leak that damages the president gets denied, aggressively, often within hours. This one was confirmed within days, casually, on Air Force One. Trump treated it as a given.
If I'm running the framework, this looks like an authorized leak from the US side, confirmed strategically to own the narrative.
That's my assessment. I'd put it at about eighty percent probability. The remaining twenty percent is the possibility that someone on the Israeli side leaked it to pressure Netanyahu domestically, and Trump confirmed it because he decided he didn't mind the portrayal. But the Axios channel strongly suggests US sourcing.
Now, there's a deeper question here that I think is worth pulling on. In a world where every leak is suspect, does the concept of a "real leak" even survive? Or is all information management now?
That's a genuinely unsettling question. I think the concept survives, but the burden of proof has shifted. Twenty years ago, the default assumption was that a leak was real unless proven otherwise. Today, I think the savvy default is skepticism — assume a leak is strategic until the evidence pushes you toward genuine breach.
That shift has consequences. If every leak is suspect, then real whistleblowing gets dismissed as media management. The genuine exposure of wrongdoing gets caught in the same filter as the strategic plant.
Which is, of course, part of why the strategic leak works so well. It degrades the information environment. It creates a fog where nothing can be trusted at face value. And that fog benefits the people doing the strategic leaking, because when a real leak does come out — a genuine exposure of misconduct — they can say "just another planted story" and a significant portion of the public will believe them.
The cynicism is the point.
The cynicism is the shield. And this is where it connects to the broader disinformation landscape. As AI-generated content improves, the ability to fabricate convincing leaks will become trivial. We're already seeing AI-generated audio that can clone a voice from a few seconds of sample. Imagine a "leaked" audio recording of a presidential call that was never made, generated by an adversary, released through a cutout to a sympathetic outlet. How do you debunk that?
You'd need verification infrastructure that doesn't currently exist at scale. Cryptographic signing of official communications. Chain-of-custody protocols for transcripts. The kind of thing that's technically straightforward but politically impossible because it would constrain the strategic leak as a tool.
The strategic leak relies on ambiguity. Verification infrastructure eliminates ambiguity. So there's no incentive for the people who benefit from strategic leaking to build the infrastructure that would prevent fabricated leaks. It's a classic collective action problem with a twist — the people who could solve it are the ones who benefit from not solving it.
Where does this leave the informed news consumer? What's the practical toolkit?
I think there are three questions you can ask, and they work surprisingly well. Question one: who benefits? If the answer is the person who supposedly got leaked against, it's probably authorized. If the answer is their political opponents, it's probably real.
Question two: how specific is it? Real leaks have details that don't serve the narrative. The exact time of the call. The tone of voice. The awkward pause. The thing that makes someone look bad in a way that's not the main point of the story. Narrative leaks are smooth; real leaks have texture.
Question three: how was it denied? A non-denial denial — "I don't recall," "that's not my recollection," "I'm not going to comment on private conversations" — is a tell for authorized. A flat denial — "that never happened, that quote is fabricated" — is either true or a lie, but it's not the calibrated ambiguity of the strategic leak. And if there's no denial at all, just confirmation, you're looking at an authorized disclosure that has served its purpose.
The confirmation as the final move. The leak was the opening, the confirmation is the endgame.
That's what we saw here. The Axios story plants the information. Trump confirms it. The cycle is complete. The message has been sent to Netanyahu, to the region, to the domestic audience — without a single on-the-record statement from the White House press secretary. It's efficient, it's deniable until it isn't, and it shapes the narrative without leaving fingerprints.
The fact that we can reverse-engineer it this way doesn't mean it's not effective. Most people don't run a three-question framework on their morning news. They see the headline — "Trump Calls Netanyahu Crazy" — and they react. The strategic leak works on the emotional level even when the analytical level can see the strings.
That's the sophistication of it. The strategic leak doesn't need to fool the analysts. It needs to reach the audience that doesn't analyze. And the architecture is designed for that audience — the headline is the payload, the attribution is the camouflage, and the confirmation is the amplifier.
To pull this all together for the listener who sent this in — the pool on a US-Israel bilateral call is twelve to eighteen people in the room, but the real leak pool is probably fifty to sixty when you include debrief chains and staff. The small-pool argument is directionally right but understates the complexity. And leaks of this nature are often authorized — not always, but the indicators in this case point strongly toward strategic disclosure.
The way to tell the difference, from the outside, is the three-question test. Run that on the next bombshell leak that hits your feed and see what you get. It's not foolproof — no framework is — but it's a lot better than treating every leak as either gospel or garbage.
The thing I keep coming back to is how much of what we call "leaks" are really just the government communicating in its native language. The press release is for formal announcements. The leak is for everything else.
The leak is the informal communication channel of the state. It's the backchannel made public. And once you see it that way, the whole "leak investigation" theater makes more sense. The administration expresses outrage, announces a probe, vows to find the leaker — and the probe goes nowhere, because the leaker was the guy who announced the probe.
Like investigating yourself for a crime you asked yourself to commit.
Finding yourself innocent, after a thorough and rigorous inquiry.
Of course there are.
Now: Hilbert's daily fun fact.
Hilbert: In the seventeen eighties, a prominent theory among European antiquarians held that medieval kings were crowned while seated on an actual captive bear, not a throne — the belief being that the bear's submission symbolized the monarch's dominion over the wild. The theory persisted for decades before anyone pointed out that coronation records never mentioned bears, and that getting a bear to sit still for a ceremony would be logistically impossible.
I have so many questions about the bear-throne theory, and I suspect none of them have good answers.
The image of a medieval king trying to maintain dignity while a bear decides it's done sitting is going to stay with me.
So here's the open question we want to leave you with. As AI-generated disinformation gets better, the ability to fabricate a convincing leak — complete with fake audio, fake transcripts, fake source attributions — will become trivial. The detection framework we've outlined today works for now, but it relies on patterns that can be simulated. If you can generate a "leak" that's lumpy, specific, and damaging to the supposed leaker, and release it through a cutout that looks hostile, you've beaten the framework. What does verification look like in that world?
I don't think we know yet. But I think the answer involves moving from content analysis to provenance analysis — not "does this look real?" but "can we prove where this came from?" And that's a technical challenge that the journalism industry is only beginning to grapple with.
Something to chew on. Our thanks as always to Hilbert Flumingtop for producing. This has been My Weird Prompts. You can find every episode at myweirdprompts.com or wherever you get your podcasts. If you enjoyed this, leave us a review — it helps.
If you want to send us a prompt like the one we tackled today, you can reach us through the website. We read everything.
Until next time.
