I would leak printed documents - preferably not with a Laserjet - by sending them, not sent from my hometown but random (does this make it less secure? pattern detection? gas stations linked to my VISA?) towns. And make sure - difficult (re-OCR to text? high contrast?) - they are not marked (dot-marked, whitespace-marked, font-marked, ...) to me.

I'd prefer that way to any long chain of online trusted systems of which only one needs to leak. To me digital OpSec feels more difficult to maintain.

Add a printed PGP key and the reporter can post more questions online on their homepage (could the NSA detect cut&paste? JS-events with injected JS?).