source GAIA package: Sx_MilitaryTimes_M6201110112190319_5675.zip Origin key: Sx_MilitaryTimes_M6201110112190319 imported at Fri Jan 8 18:18:05 2016
Hearing coverage
Agent: Manning's laptop had sensitive files (Dec. 19) Army agent testifies on Manning's digital trail (Dec. 19) Co-workers: Manning, others ignored security (Dec. 18) Manning's personal problems key to defense (Dec. 18) Manning's sexual orientation raised in hearing (Dec. 17) Army disciplines 15 for Manning supervision (Dec. 17) Investigator won't step down in Manning hearing (Dec. 16)
FORT MEADE, Md. — Army cyber detectives on Monday offered damning evidence a computer belonging to Pfc. Bradley Manning was used to contact WikiLeaks founder Julian Assange, send sensitive documents and make flawed attempts to hide his tracks.
"I was the source of the 12 July 2007 video from the Apache Weapons Team which killed two journalists and injured two kids," Manning wrote to a contact named Eric Schmeidl. The email refers to the source material for a now-infamous video published by WikiLeaks in 2010 that showed U.S. forces attacking a news crew.
Investigators from the Army Criminal Investigation Command's Computer Crime Investigative Unit testified on the fourth day of hearings to determine whether Manning should be court-martialed on 22 charges, including aiding the enemy.
Manning, 24, of Crescent, Okla., is accused of giving WikiLeaks a trove of sensitive government material while working as an intelligence analyst in Iraq in 2009 and 2010, including Iraq and Afghanistan war logs, and State Department cables. If convicted, he could face life in prison.
Investigators detailed how they used Manning's seized electronics — two classified laptops, his personal MacBook Pro, a hard drive and a memory card — to retrace downloads of sensitive documents, uploads to WikiLeaks and pages of Internet chats with Assange.
Agents: Manning made mistakes
For all of Manning's computer savvy, investigators say a series of amateurish slips led them to him: He cursorily erased his MacBook and aborted a more thorough method. He used a single password for his MacBook, chat program and encryption software. He encrypted emails to Schmeidl but not the one in which he takes responsibility for the Apache video leak.
A hard drive found in Manning's quarters on Forward Operating Base Hammer, in Baghdad, contained both an operational security briefing he delivered in 2008 and a text file that contained Assange's phone number.
"You can currently contact our investigations editor directly in Iceland at 354-862-3481 : 24 hour service : Ask for Julian Assange," the message reads.
Investigators said they seized a memory card in the home of Manning's aunt after Manning's arrest in 2010, from which they recovered crucial evidence. Although the files on the memory card were encrypted, deleted and partially unrecoverable, investigators retrieved Manning's password, which enabled them to decrypt some of the war logs, investigator David Shaver said.
This revealed deleted Iraq and Afghanistan war logs, a photo Manning took of himself in January 2010 and a text file, Shaver said. The war logs, in a compressed file, contained significant action reports from the Defense Department and Combined Information Data Network databases — 91,000 from Afghanistan and 400,000 from Iraq.
The text file, named "Read Me," describes the compressed file as, "items of historical significance of two wars. Iraq and Afghanistan Significant Activities (SIGACTS) between 0000 01 Jan 2004 and 2359 31 Dec 2009."
"You might need to sit on this information for 90 to 180 to figure out how to best send and distribute such a large amount of data to a large audience and protect the source," it reads.
It adds: "This is one of the most significant documents of our time, removing the fog of war and revealing the true nature of 21st Century asymmetric warfare. Have a good day."
Under questioning by one of Manning's attorneys, Capt. Paul Bouchard, Shaver said he had no knowledge of what happened to the memory card between Manning's May 2010 arrest and the search of the Potomac, Md., home last December.
Transcripts of chats with Assange uncovered
Investigators said they were able to recover — thanks to two flawed wipes of Manning's MacBook — 14 pages of deleted Internet chat logs between Manning's handle, "bradass87," and two handles investigators say are linked to Assange.
"They had been in contact with each other," said Mark Johnson, a CCIU investigator and contractor who examined the laptop. "They are talking about, did you receive the information?"
File logs show an attempt was made in January 2010 to wipe out the hard drive by reinstalling the operating system. But when it came time to pick a deletion method, logs show the more comprehensive option of making "35 passes" was aborted in favor of the quicker single pass, Johnson said. It was a lucky break for investigators who were later able to fish out the deleted files from the computer's unallocated memory.
Johnson said he found references on Manning's Mac to a WikiLeaks upload page and upload status logs indicating it was used to successfully upload an encrypted seven part file. Investigators said the file contained hundreds of sensitive military files — documents, images and videos — from the investigation of a 2009 airstrike in Gerani, Afghanistan, that left dozens of civilians dead.
Although the file was partially deleted, investigators used software that reconstructed it from fragments of the original files, including a PowerPoint briefing marked "secret."
More finds
Earlier Monday, Shaver said he recovered more than 100,000 State Department cables and other sensitive information on one of the secure computers that Manning used. The cables were contained in a deleted .csv file and ordered by a message record number that indicated the embassy where they originated.
"It seemed like someone wanted to make sure they got all of them," Shaver said.
Logs on one of the former intelligence analyst's laptops showed that in March 2010 a program for aiding speedy downloads called Wget was used to access a Joint Task Force Guantanamo SharePoint server that contained detainee assessments and identification numbers.
The four complete detainee assessments found on that laptop matched Guantanamo documents published by WikiLeaks, Shaver said. The assessments were found in unallocated space on the computer, he said, indicating they had been deleted.
Defense attorneys have focused on supervisors' failure to pull Manning's security clearance in spite of his erratic and sometimes violent behavior, as well as broader security lapses in the FOB Hammer facility where Manning worked. Fifteen people, including the noncommissioned officer in charge of the facility, have been disciplined in.
Mental health experts are expected to testify for the defense in the coming days.
The Associated Press contributed to this report.
