"She said ... she was very scared," her mother, Billie Winner-Davis, told CNN's Anderson Cooper on Tuesday night. "They took her by surprise. She was not expecting any of this."
Before her arrest, the Texas-raised linguist and Air Force veteran was also known as a yoga instructor and animal lover. Her family knew almost nothing about her work life, they said.
"I didn't know what company she worked for," Winner-Davis said. "I don't know what she did when she went to work."
Her daughter called her Saturday to say she was in trouble.
Winner-Davis and her husband said they have spoken to Winner by telephone since her arrest and saw her briefly at a hearing Monday.
Winner, a contractor with Pluribus International Corp., had been assigned to a US government agency facility in Augusta, Georgia, since February 13. She had top secret security clearance.
She is accused of leaking classified information, used as the basis for an article published
Monday by The Intercept, detailing a classified National Security Agency memo. The NSA report, dated May 5, provides details of a 2016 Russian cyberattack on a US voting software supplier, though there is no evidence the hack affected any votes.
Prosecutors said when confronted with the allegations, Winner admitted to leaking the classified document intentionally.
"She was afraid she was going to disappear, that they were going to make her disappear. And she felt like she needed to give them what they were asking for at the time," Winner-Davis said.
'She served her country'
Winner served in the Air Force from December 2010 to 2016. Her rank was senior airman, and her last duty title was cryptologic language analyst
, according to the Air Force. Her mother said she speaks Pashto, Farsi and Dari.
Winner received the Air Force Commendation Medal in 2016, which is for members who have "distinguished themselves by meritorious achievement and service."
She "provided over 1,900 hours of enemy intelligence exploitation and assisted in geolocating 120 enemy combatants," the award said.
"She served her country, she is a veteran," her stepfather, Gary Davis, told Cooper. "She's a patriot, and to see her maligned and slandered in the media is very disheartening."
'I'm terrified for her right now'
She removed the intelligence reporting from her office and mailed it from Augusta, according to the affidavit in support of her arrest.
Her court-appointed attorney, Titus Nichols, cast doubt on the government's side of the story. As for her purported confession, he said, "The bigger issue is: Was my client interrogated without her attorney?"
Winner is set to go before US Magistrate Judge Brian Epps for a detention hearing Thursday in Augusta, Nichols said. The judge will determine whether to release her on bond. Winner did not enter a plea in her initial appearance Monday.
Winner-Davis told Cooper on Tuesday that if her daughter did what she's accused of, "I know that she's ready to pay the price.
"My biggest fear in all of this is that she's not going to get a fair trial," the mother said. "She's going to be made an example of."
She added: "I'm terrified for her right now because of the news, the climate, the social media."
Mom: She never praised past leakers
On Twitter, Winner posted about leaks and regularly took to social media to blast President Donald Trump
, though her Twitter activity dropped off significantly after she began working for Pluribus in February.
Winner posted under a pseudonym, Sara Winners, but didn't seem concerned with concealing her identity, using a photo of herself as a profile picture and posting a selfie in February.
Her attorney told CNN he was unable to confirm that the Twitter account was Winner's.
On Instagram, where she used the name @Reezlie, same as her Twitter handle, she mostly posted selfies from the gym or photos of food.
Winner-Davis said her daughter wasn't especially political and had never praised past leakers such as Edward Snowden to her.
But on Twitter Winner followed Snowden, WikiLeaks, several accounts with links to the hacking collective, Anonymous, and several "alt" government agency accounts that became popular after Trump's inauguration. Many of the accounts claim to be run by agency employees unhappy with Trump.
"She's never ever given me any kind of indication that she was in favor of that at all," her mother said. "I don't know how to explain it."