He is a jackass.
But I do think the correct order would be 1. Determine whether classified information was accessed illegally, 2. Determine whether it was communicated illegally, 3. Gather evidence, 4. Find those who are most likely behind it, 5. Accuse, 6. Try, 7. If guilty, punish, if not guilty, release.
The Internet is not a license to break national law.
Step one should be, determine which information was, in fact, classified. Information is not classified because some classification bureaucrat marked it classified (yes that administrative step is important, but not a final determination), but whether its release will potentially damage national security.
The fundamental problem in prosecution, in many of these cases, is the necessary step of demonstrating that harm to national security could follow the release of the information.