Recent scoops on national security have drawn the ire of Republican lawmakers, who have accused the Obama White House of leaking stories that burnish its image.

Obama responded that he has “zero tolerance” for leaks. He also said: “the writers of these articles have all stated unequivocally that they didn’t come from this White House. And that’s not how we operate.”

Someone somewhere has to be talking. Eric Holder said he’s assigned two U.S. attorneys to lead separate criminal investigations into “potential unauthorized disclosures.” Although the Justice Department won’t comment on which particular leaks are under investigation, unnamed officials (of course) have given reporters an idea.

Here’s what we know about leak investigations underway, the legality of leaks, and why leak prosecutions have been so rare.

Leak: Stuxnet

The New York Times reported that Obama ordered cyberattacks against Iran using Stuxnet, a computer virus the U.S. developed with Israel.

Sources: “participants” in the program and the attack, “members of the president’s national security team,” “current and former American, European and Israeli officials,” “one of [Obama’s] aides,” “a senior administration official.”

Investigation: The CIA reportedly sent a “crime report” to the Justice Department on the leak, and it is—as unnamed officials told Reuters—one of the two new investigations.

Leak: Foiled Underwear Bomber

The AP reported that the CIA foiled an Al-Qaeda plot out of Yemen to deploy a new kind of underwear bomb. Subsequent stories identified the role of a double-agent in stopping the plot.

Sources: “U.S. officials who were briefed on the operation.”

Investigation: The story also apparently prompted the CIA to send a “crime report” to the Justice Department, making it the second of the criminal inquiries mentioned by Holder.

Leak: The CIA’s drone program

The CIA’s drone program and targeted strikes have been written about for years, but recent articles from Newsweek and the New York Times got particular attention.

Sources: Too many to count. The Times article alone cites “three dozen of [Obama’s] current and former advisers.” Staffers from the House and Senate Intelligence committees—whose members have been among the most vocal in their concern about leaks—were cited just last week in an article on CIA drone strikes.

Investigation: Apparently not. The CIA reportedly hasn’t filed a report on drone leaks. Unnamed officials told Reuters one reason is that the CIA’s drone program has already been so openly discussed (this despite the government’s position in a separate case that the public doesn’t know the program exists). A Justice Department official recently noted to Congress that agencies sometimes don’t request an investigation because of “wide dissemination” of the leaked information.

What laws have leakers violated?

There is no single law making the disclosure of any information stamped “classified” a crime. The Espionage Act has been used, though rarely, to prosecute the leaking of national security information. There are also laws on computer hacking and a patchwork of other statutes.

Under most of these laws, it’s not enough to show that someone leaked—the government needs to prove they did so with intent or reason to believe that the information would hurt the U.S. or help a foreign country. Prosecutions of media leaks can also be hampered by First Amendment protections. (For an in-depth legal history, see this report from the Congressional Research Service). In some cases the government has decided not to prosecute because classified information would be confirmed or further revealed in the process.

From 2005 to 2009, the Justice Department got 183 “crime reports” on leaks from others in the government. Those notificationsled to 26 investigations. (The Justice Department can also start an independent investigation without a referral.) Obama has already brought six prosecutions under the Espionage Act, though many of the investigations were initiated under George W. Bush. Email and other technological changes have also made it easier, in some cases, to track leakers.

So what comes next?

If the Justice Department decides not to prosecute, the case goes back to the agency that reported it, which could take administrative steps to punish a leaker, anything from a reprimand to stripping security clearance.Many Republican senators have said the Justice Department isn’t sufficiently independent to investigate potential White House leaks. Last week more than 30 senators sent a letter calling for a special counsel. They also suggested a congressional investigation could be launched.

In response to recent leaks, Director of National Intelligence JamesClapper—who oversees the seventeen-agency intelligence community—issued a new directive asking the intelligence community’s inspector general to lead further investigations in some cases where the Justice Department decides not to. Such an investigation wouldn’t be a criminal inquiry, but it would reach beyond the scope of one agency. According to a DNI spokesman, the new investigative power wouldn’t apply to leaks from the White House or non-intelligence agencies—but if the investigation pointed to a leaker outside the intelligence community, “there would be a process to make sure the employer was notified and could take their own steps.”

The directive also mandates that intelligence employees getting periodic polygraph tests be asked if they’ve leaked information. Earlier this month, another DNI directive said personnel with access to national intelligence (and that’s a lot of people) would be “continually evaluated and monitored.”

Members of both the House and Senate have indicated they are working on legislation efforts to stem future leaks, but details are still unclear.

Aren’t leaks par for the course in Washington?

That’s part of the reason Congress hasn’t made a comprehensive law penalizing them. In 2000, Bill Clinton vetoed a provision making it easier to prosecute leaks, saying it was too broad and would have had a “chilling effect” on legitimate communications.

Administrative penalties and the tools for criminal investigations that the government already has are sufficient, maintains Elizabeth Goitein, of the Brennan Center for Justice. Goitein says that new crackdowns could have an effect on would-be whistleblowers. Intelligence employees are specifically exempt from the Whistleblower Protection Act, which gives most government employees protection from retaliation for reporting wrongdoing. The government’s position (as the DOJ told us in February) is that there are internal channels by which intelligence employees can report issues and the media is not one of them.

A spokesman for the DNI said that it was “the Director’s number-one concern” that his new anti-leak policies were implemented without affecting whistleblowers.