Another NSA Leaker Identified and Charged
schneier.com
schneier.com
That sounds like they used his Google Account/iCloud account to find back-ups and that was how they found that information. Otherwise, that's oddly specific for having been almost five years ago, now.