Baltimore:

1500 N Charles St  Baltimore, MD 21201

1. Walk to Charles St. & Penn Station

2. Take the 3 Bus towards 3 Cromwell Bridge 11:14 am-11:19 (6 mins, 7 stops)

3. Get off at Charles St & 27th

4. Head north on N Charles St toward E 27th St.

5. Turn right onto E 27th St.

6. Turn right onto St. Paul St.

7. Arrive at 2640 St. Paul St., Baltimore, MD

For more information, please click here

NYC:

Address: 234 W 31st St, New York, 10001

1. Walk southeast on W 31st St. toward 7th Ave

2. Turn left onto 7th Ave

3. Turn right onto W 32nd St

4. Take the M4 Bus towards Washington Hights Cloisters via Madison via Broadway 11:20am-11:21am (1 min, 1 stop)

5. Get off at Av of the Americas

6. Head southeast on W 32nd St toward Broadway

7. Turn left onto Broadway

8. Arrive at 1270 Broadway, New York, NY 10001

For more information, please click here

Washington DC:

Address: 50 Massachusetts Ave NE, Washington, DC 20002

The Amtrak arrives at Union Station Metro Station. The Charter Bus will be waiting at the same station and will be within 4 minute walking distance.

Directions from Greyhound Stations to Charter Buses

Baltimore Greyhound Station 2110 Haines St.

Baltimore Downtown, MD 21201

1. Take the 27 Bus towards 27 Reist Plaza Station 10:43am – 11:05 (22 mins, 21 stops)

2. Get off at Remington ave & 27th St

3. Walk southeast on Remington Ave toward Cresmont Ave

4. Turn left onto W 27th St.

5. Turn right onto St. Paul St.

6. Arrive at 2640 St. Paul St.

NYC (At Penn Station)

460 8th Ave, New York

1. Walk to W 32 St. and 7th Ave (About 1 min, 220 ft)

2. Take the M4 Bus towards Washington Heights Cloisters via Madison via Broadway 11:20am-11:21am (1 min, 1 stop)

3. Get of at Ave of the Americas

4. Walk southeast on W 32nd St toward Broadway

5. Turn left on Broadway

6. Arrive at 1270 Broadway, New York, NY 10001

For more information, please click here

New York:

625 8th Ave, New York

1. Walk to TImes Sq and 42nd St. (About 5 mins, 0.3 mi)

2. Take the N, Q, or R trains towards Coney Island – Stillwell Ave/ Bay Ridge-95 St. 11:20am-11:22am (2mins, 1 stop)

3. Get off at 34 St. – Herald Sq.

4. Walk southwest on 6th Ave toward Broadway

5. Slight right to stay on Broadway

6. Arrive at 1270 Broadway, New York, NY 10001

For more information, please click here

Washington DC

1005 1st St NE  Washington, DC 20002

1. Take the M Red Subway towards Glenmont 11:17am-11:19am (2 mins, 1 stop)

2. Get off at Noma-Gallaudet U (New York Ave) Metro Station

3. Head south on Metropolitan Branch Trail (take the stairs)

4. Turn right onto L St. NE

5. Turn left onto First St. NE

6. Arrive at 1005 1st St. NE, Washington, DC 20002

For more information, please click here

Buses

Charter buses are scheduled to Ft. Meade from the following cities: NYC, Washington DC, Baltimore and Hartford, CT.

Find directions from airports to charter buses OR from Amtrak and Greyhound stations to charter buses in Baltimore, DC and NYC using public transit.

If you’re arriving at the BWI Airport on June 1st, there is also a regional bus from the airport to Arundel Mills Shopping Center (Bus 017), from which you can then take the CTC K to the Main Gate.  The entire trip is approximately 45 minutes.  For a Google Maps public transit view of this option: http://alturl.com/3ehis

Still interested in organizing a bus or van from your city?  We’re offering small grants to help.

Driving to Ft. Meade

From most locations, driving will be the quickest way to access Ft. Meade.  If you plan to fly into the area and rent a car,  priceline.com and hotwire.com are two useful sites for finding budget rentals.

Free parking has been arranged at Meade Heights Elementary School, 1925 Reece Rd, Fort Meade, MD 20755. This parking lot is only half a mile (11 min. walk) from the the Ft. Meade Main Gate.

Additional parking is available at Van Bokkelen Elementary School, 1140 Reece Road, Severn, MD 21144. This parking lot is one mile (24 min. walk) from the Ft. Meade Main Gate. We’ll try to shuttle folks along Reece Road.

There are a small number of unrestricted parking spaces along US 175; however, do not park in the the mini-shopping centers or the Weis Market near Blue Water Blvd.

Housing options

Search Priceline for hotels near Ft. George G. Meade, MD

View a list of other hotels in DC, MD and VA.

Mass housing options

There are also two campgrounds in the area, Cherry Hill Park near Washington D.C. and Greenbelt Park in Greenbelt, MD.  The campground fee is $16.

Navigation

Google maps usually has up-to-date road and public transit information.  You can also download apps and links for navigation in the DC area, MD and NYC

Carpooling

If you are able to offer rides to others, please e-mail emma@bradleymanning.org with your planned departure date, time, location, and how many seats you are offering.  Carpool information for those looking for rides will be posted on this page as it becomes available.

Ft. Meade Security

Our event on June 1st will take place outside the Fort Meade Main Gate at 175 Maryland and Reece Rd.  However, if you plan to stay to attend Bradley’s court martial, which begins June 3rd, you’ll need to be prepared to go through security checkpoints.

To enter Ft. Meade, you’ll need a government issued ID, such as a state issued drivers license or passport. Non-US passports are accepted. Be prepared to remove any shirts or buttons that show support for Bradley Manning while on base.

The courtroom is located 1 mile past the main gate, and maps are available at the Visitor Control Center immediately inside the gate and to the right.  There is parking by the courtroom, space allowing.  To drive onto Ft. Meade:

• Have your up-to-date vehicle registration
• Have your up-to-date vehicle insurance (printed copy–not a electronic version on your mobile phone)
• Obey posted speed limits (they are strictly enforced by military police–especially for “special visitors”)
• Be prepared to cover “political” bumper stickers on your vehicle with tape

Unlike most trials, the government is refusing to release any official transcripts of the trials. It is up to the public to attend, and comment on, what happens inside the otherwise secretive court room. Thank you for your support and please join us at Fort Meade!

2294 Blue Water Blvd, Odenton, MD.  

View Larger Map

Driving Directions to Weiss Parking Lot from Airports in Baltimore and DC:

Baltimore:

Baltimore/Washington International Thurgood Marshall Airport

1. Head northeast

2. Continue straight onto I-195 W (Signs for Maryland 170/Maryland295/Interstate 95/Annapolis/Baltimore/Washington)

3. Take exit 2B for Maryland 295 S/Balt/Wash Pkwy toward Washington

4. Merge Onto MD-295 S

5. Take the exit onto MD-32 E toward Ft Meade

6. Take exit 6 for MD-175 toward Odenton/Ft.Meade

7. Keep left at the fork, follow signs for Maryland 175 W/Fort Meade

8. Turn left onto MD-175 W/Annapolis Rd

9. Turn right onto Blue Water Blvd

10. Make a U-turn

11. Arrive at Weis Markets 2294 Blue Water Blvd, Odenton, MD 21113

For more information, please click here

Washington, DC:

Dulles International Airport

1. Head east on Saarinen Cir

2. Continue onto Dulles Access Rd

3. Take the exit toward i-495 N

4. Keep left at the fork, follow signs for Interstate 495 N/Baltimore and merge onto I-495 N (entering Maryland)

5. Merge onto I-495 /I-95 S

6. Take exit 22A for Balt/Wash Pkwy toward Baltimore N

7. Merge onto MD-295 N

8. Exit onto MD-198 E/Fort Meade Rd/ Laurel Fort Meade Rd toward Fort Meade continue to follow MD-198 E/Laurel Fort Meade Rd

9. Take the ramp onto MD-32 E

10. Take exit 6 for MD-175 toward Odenton/Ft. Meade

11. Keep left at the fork, follow signs for Maryland 175 W/Fort Meade

12. Turn left onto MD-175 W/Annapolis Rd

13. Turn right onto Blue Water Blvd

14. Make a U-turn. Destination will be on the right

15. Arrive at Weis Markets 2294 Blue Water Blvd, Odenton, MD 21113

For more information, please click here

Ronald Reagan National Airport

1. Head north on Aviation Cir

2. Slight right onto S Smith Blvd

3. Take the ramp onto George Washington Memorial Pkwy

4. take the I-395 N ramp to Washington

5. Merge onto I-395 (entering District of Columbia)

6. Continue onto Southwest Fwy

7. Take the exit onto District of Columbia Hwy 295 (entering Maryland)

8. Continue onto MD-295 N

9. Exit onto MD-198 E/Fort Meade Rd/Laurel Fort Meade Rd toward Fort Meade

10. Continue to follow MD-198 E/Laurel Fort Meade Rd

11. Take the ramp onto MD-32 E

12. Take exit 6 for MD-175 toward Odenton/Ft. Meade

13. Keep left at the fork, follow signs for Maryland 175 W/Fort Meade

14. Turn left onto MD-175 W/Annapolis Rd

15. Turn right onto Blue Water Blvd

16. Make a U-turn. Destination will be on right

17. Weis Markets 2294 Blue Water Blvd, Odenton Md 21113

For more information, please click here

Getting to Fort Meade from the parking lot:

Walking:

1. Head southeast on Annapolis Rd toward Reece Rd

2. Turn left onto Blue Water Blvd

Estimated travel time: About 21 mins (1.1mi).

Travelers are advised to use caution, this route may be missing sidewalks or pedestrian paths.

For more information, please click here

By Bus:

Estimated travel time: 23 mins. Trip fare: $1.75

1. Head west on Blue Water Blvd toward Annapolis Rd

2. Turn right onto Annapolis Rd

3. Turn right onto Charter Oaks Blvd

4. Take the K Bus towards Arundel Mall 12:11 pm-12:25 (14 mins, 1 stop)

5. Get off at Annapolis Rd at Reece Rd (Stop ID: 452)

6. Walk to Fort Meade (About 2 minutes, 320 ft)

7. Head south toward Annapolis Rd

8. Sharp right onto Annapolis Rd

9. Arrive at Fort Meade

For more information, please click here

A song by Ryan Harvey for Bradley Manning, to build towards the June 1st, 2013, mass actions at Fort Meade, Maryland.

Ride the bus to the June 1 protest! Buses have been organized from Baltimore, New York City, and Washington DC.

Next hearing to focus on military’s “cruel, inhuman, and degrading” of accused WikiLeaks whistle-blower

Bradley Manning Support Network. July 19, 2012.

FORT MEADE, Maryland – Establishing yet another obstacle for P.F.C. Bradley Manning’s legal defense, military judge Denise Lind ruled Thursday that defense lawyer David Coombs will be substantially hindered from showing how WikiLeaks’ releases didn’t bring damage to U.S. national security. In largely granting a government motion to preclude discussion of actual damage, Lind said that harm or lack thereof is irrelevant to Manning’s guilt or innocence.

“Bradley should be able to argue that he had a reasonable belief that no harm would come from his alleged actions by showing that no harm actually occurred,” explained Jeff Paterson of the Bradley Manning Support Network. “This is another attempt to silence Bradley’s lawyers from depicting the Nobel Peace Prize nominee as a whistle-blower.”

The prosecution continues to argue that the releases “could” cause harm at some point in the future.  Coombs says that after two years without damage, that theory “rings hollow.” Coombs previously requested damage assessments from 63 government agencies, and the 28 who replied thus far have described little or no damage.

Manning’s next hearing at Fort Meade, Maryland, August 27-31, will highlight the illegal and torturous treatment the military subjected Manning to at the Quantico Marine Base, Virginia. Coombs is expected to argue for dismissal of all charges based on the military’s flagrant violation of Article 13 of the Uniform Code of Military Justice that prohibits all pre-trial punishment “any more rigorous” than required to ensure the accused appears at court hearings.

Judge Lind today ruled that she would not allow United Nations torture rapporteur Juan Mendez to testify about Manning’s unlawful confinement conditions, declaring his testimony irrelevant, even though the torture chief called Manning’s treatment “cruel, inhuman, and degrading” after a 14-month investigation. Officials at Quantico refused to allow Mendez unmonitored access to Manning. “Military Judge Lind’s ruling in effect rewards the military for stonewalling the U.N.,” declared Paterson.

A Quantico staff member is expected to testify to the illegal treatment that Manning endured at the upcoming hearing in late August. In his brief filed with the court, Coombs states that the truth will “shock the conscience of the court.” Supporters will underscore the cruelty of Manning’s conditions by holding a rally at the Fort Meade Main Gate on August 27. Attorney David Coombs is expected to appear at an August 26 public event in Washington, DC, (details to be announced soon) organized by the Bradley Manning Support Network.

Officials at the pre-trial hearing believe it could be months before an official transcript is made available. We believe people around the world have a right to be in the courtroom seeing history unfold, so we’re doing out best to document as much as possible for the historical record and to shine a light on this trial. We urge citizen journalists to join our efforts and help us document the pretrial and any future proceedings as closely as possible.
See:
Day One
Day Two
Day Three

Getting to the Courtroom

This morning was a bit warmer at Fort Meade, and I passed through the metal detectors without difficulty. I also quizzed the military police about whether they would open the overflow theater today. They said they would not.
The Article 32

9:31 AM Lt. Col. Paul Almanza, serving as the investigating officer for the Article 32 trial, entered and called the hearing to order. As typical, he reminded the spectators about the need to preserve the dignity and decorum of the proceedings by not interrupting or having cellular devices, and warned that individuals violating this policy would be removed.  He did not warn individuals about notifying the IO before they discuss classified information; I assume he just forgot.

Special Agent David Shaver

Agent Shaver, the forensic agent who testified yesterday, was called forward to be cross-examined by the defense team. Capt. Blouchard stepped forward.  Unlike Coombs and Kemkes, Blouchard has a stilted courtroom style. He occasionally uses the wrong word in his questioning and pauses between questions to refer to his notes.

Upon questioning, Shaver explained that he had done a bit-by-bit analysis of the SIPR computer assigned to Manning. He admitted that he had not done forensic analysis on all of the computers in the SCIF where Manning was station. Shaver thus did not know whether other computers in the SCIF might also have wget installed. [As a refresher for those who haven’t read previous notes, the “SCIF” is where Manning worked and wget is an open-source program that can, with a little script writing from the user, be used to automate downloading files.  The prosecution is alleging that Manning used wget to download classified documents.]

Shaver explained that he had found diplomatic cables in a file called “files.zip” on the allocated spaces of Manning’s assigned SIPR computer.  Shaver compared these cables to the cables released by Wikileaks and found that they were not a match.
Blouchard asked whether Shaver released that analysts like Manning had been directed to work on these embassy cables as part of their job. Shaver did not realize that.

Shaver explained that he couldn’t date or time stamp information in the unallocated (deleted) spaces.  He also was unable to say that files in the unallocated spaces had been associated with a particular user.

Shaver testified that he did find, in the unallocated space, a copy of the video file from the Apache airstrike later released on WikiLeaks. Upon questioning, he admitted that he did not realize that people in Manning’s unit were watching this video back in Dec 2009.  Shaver also admitted that there was nothing wrong with having a security-cleared user collect video feed.

Shaver also noted that Wget was used to download detainee assessments. He found 4 complete detainee assessments in the allocated files, and none in the unallocated files.

Blouchard settled back into his seat and the government stood for a quick clarification from Shaver.   Upon questioning by the prosecution, Shaver explained that he didn’t believe any of the cables stored in the files.zip  files on Manning’s computer were later released by WikiLeaks. He also explained that the files might never have been released because the file was partially corrupt. Shaver was able to access it because he used forensic tools.

Shaver testified that he used information obtained evidence from Index.dat , which is a Microsoft tools that logs all the websites ad files viewed by a user.

Shaver did not find any data related to the Farah case on the unallocated spaces.

At this point, the public and media was asked to leave the courtroom so that the witness could be questioned on classified matters.

Lt. Dan Choi Detained, Removed

Shortly after 10:00 AM, the members of the public watching the hearing filed outside to the courtyard and the heated trailer to await the hearing reopening.  When we arrived in the courtyard, we met famed Pentagon whistle-blower Daniel Ellsberg and Lt. Daniel Choi, an outspoken proponent for the abolition of Don’t Ask, Don’t Tell who is currently engaged in a lawsuit with the government to be able to return to the Army after he was removed for being openly gay.

Choi, wearing dress blues, explained that he was detained for a long period of time at the Visitor’s Entrance when attempting to come on base. The soldiers at the gate prevented him entrance because they did not believe he was allowed to wear a military uniform when he couldn’t produce a current military ID. Due to this lengthy delay, Ellsberg and Choi were late in arriving at the courtroom.  When they arrived, they were denied entrance because the court was in session – even though many had been let in late the prior afternoon and earlier this morning. The decision to allow late entrance seemed arbitrarily and spitefully enforced.

After hearing this story from Choi, I stepped into the heated trailer and so was unable to see what occurred next.

According to witnesses I spoke to afterwards, soldiers who had been speaking with Choi grabbed him and dragged him into the security trailer.  One lawyer on hand expressed concern at the rough treatment he received, and another individual said they physically lifted Choi at one point in pushing him into the security trailer.  Once inside the security trailer with a number of military police, we could hear sounds of loud thumping. Those of us outside were prevented from seeing what was occurring and the Military Police (MP) blocked access to the trailer. We were unable to speak to Choi and it was unclear why he was being taken away in this manner.

The MPs did not bring Choi out of the security trailer during the rest of the recess.  We were then escorted back to the courtroom.  Jennifer Robinson, one of Assange’s lawyers, stayed outside to ensure Choi was unharmed when he was removed. She said that Choi was not charged with anything.

While waiting in the antechamber to return to the courtroom, I asked the lead MP if there was a way to request that the overflow theater be made available. Clearly, individuals like Ellsberg and Choi were prevented from seeing the proceedings this morning – a situation easily prevented if there was a secondary feed available from a different room such as there had been on the first two days of the hearing.  The MP said that there was no way for this to happen. I reiterated my question, explaining that I wasn’t asking him to reopen the theater but merely asking who I could speak  to formally to request the theater be reopened. He told me there was no way to make a request that the theater be reopened to the public.

Special Agent David Shaver

At 10:14 AM the media and public reentered the courtroom.  Almanza reviewed the decorum procedures and then the prosecution began questioning Shaver once more. This time the focus of their discussion was on a computer referred to as the “.40” – this was the Del SIPR computer that Manning shared with Madaras. According to testimony provided yesterday, this computer had an IP address of 22.225.41.40 and was known as Manning’s secondary computer since the Manning user profile had less frequent activity on this device.

Shaver began by reviewing what an IP address was, and then explained that the .40 Windows machine had a CD burner and Roxio CD burning software installed, but that the USB ports had been disabled as as standard.  He then discussed the naming convention for Roxio CDs which typically followed the protocol of <2 digit year><2 digit month><two digit day>_<2 digit hour><2 digit minute>. [So, for example, a file name might be 101219_0525.]

The prosecution brought up a slide.  It showed a file that was found on a virtual machine copy of Manning’s .40 computer, with a Roxio-style  naming protocol.

Shaver explained that his investigative plan was to verify the fingerprint of the forensic image that was a copy of the Manning-assigned .40 computer, then look for information related to State Department Cables, detainee assessments, etc.

In unallocated spaces

Under questioning, Shaver began by describing what he had found in the unallocated (deleted) spaces.  He stated that he had found a CSV file of over 100,000 State Department cables converted to Base 64 encoding.

The courtroom is set up with computer monitors in front of the prosecution, the defense, and on a larger drop-down screen to the left side of the courtroom across from the jury box. There are also two hanging monitors, one on either side of the court, facing the public.  When documents were pulled up for the hearing, each of these screens showed identical content. It’s possible that there was an additional monitor directly in front of the investigating officer, though I couldn’t see it. Having information on these screens was helpful, though unfortunately the text was often too small to be clearly visible to the audience. I did my best to take what notes I could.

The prosecution pulled up on the screens a portion of the CSV file that showed several unclassified pieces of information.  The CSV file was arranged into the following 5 columns:

A unique number | data the cable was published to the Department of State server | Message Record Number (a labeling system of the Department of State that included year, embassy, and an ascending number) | classification | Base64 encoding

Shaver explained that he was able to decode the Base64 encoded materials into plain text.  However, he could not associate the CSV file with a particular user profile because it was in the unallocated space. Shaver said that one way to decode the data would be to create a script that would allow you to automate the decoding of information quickly.  He did not locate such a script on the computer.

The next screen showed a warning that was displayed when individuals used the .22 and .40 machines. It displayed every time an individual logged onto the computer and explained that the computer was U.S. government property.  [NB: I couldn’t get the full warning written down before they changed screens. I’d love to include the words from the image here. Please email it to rainey@bradleymanning.org and note whether you are providing a copy of the version shown in today’s hearing or just a generic warning message from a government computer.]

At this point, the prosecution finished this line of questioning and Capt. Blouchard of the defense stepped in.  Upon questioning by Capt. Blouchard, Shaver noted that he could not associate a particular person with a profile (he doesn’t know who is behind the keyboard). Furthermore, he had no way to know if passwords were shared.  He also noted that there were not times or dates associated with unallocated spaces.

In addition, Shaver noted that the computer in question was a classified computer and there was nothing wrong with having this information on there. He stated that there was no forensic evidence on this computer that any of this information was sent to anyone.

At 10:26 AM, Shaver was temporarily excused.

Specialist Eric Baker

10:26 AM The prosecution next called Specialist Eric Baker, who served with the 62nd MP detachment.  “MP” stands for military police.  Baker had been in the army for 3 years 11 months, serving as an MP the entire time. He was Manning’s roommate in Iraq.

Baker stated that Manning and he had done two rotations together – one for Afghanistan when they expected to be deployed there and one for Iraq.   Baker explained that they were deployed together in Iraq from October 2009 till Manning’s arrest in May 2010.  He admitted that there was “not too much interaction at all” between himself and Manning.  He noted that Manning “used the computer quite often” and that he would wake up in the middle of the night and see Manning using his computer. Baker never saw what was on the screen.

Manning took a mid-tour leave in mid-January, about two weeks before Baker’s own leave.  Baker didn’t know exactly when Manning returned but believe it was in early February.  Baker noted Manning had a few computer devices in the CHU – a microphone, a Mac Book Pro, an ipod touch, external harddrive, CDs. [NB: He may have mentioned other items that I did not write down, but I think I got them all.]  Baker stated he never used Manning’s Mac Book.

Manning had music on and iPod Touch and on rewritable CDs.  Baker didn’t have any rewritable CDs. Baker testified that he didn’t have anything marked secret and never brought anything secret into the CHU.

The prosecution then asked if Baker he knew Manning’s thoughts on the military.  The defense objected, asking for the relevance.  The prosecution explained that this would speak to Manning’s state of mind.  The investigating officer overruled the objection.

Baker said he thought Manning felt the military wasn’t for him, and that he was probably going to get out.

With that, the prosecution rested and David Coombs stepped up to question the witness.

Coombs began by asking how Manning had been assigned to be his roommate.  Baker explained he was the last person to get to FOB Hammer, and so that was the only room left.  Upon questioning by Coombs, Baker admitted that he and Manning were not friends. They didn’t talk, and in fact conversation was limited to small things like asking to have a light switch turned on or off.

On questioning, Baker admitted that early on Manning had said things that made Baker think Manning was gay. And, after that, Baker had more or less told Manning that it would be better if they didn’t converse much except  as necessary.

When he wasn’t working, Manning spent a lot of time in the room.  Baker couldn’t recall any time he saw Manning  hanging out with other soldiers except when they were eating chow.

Coombs asked Baker if anyone had ever told him that he couldn’t have CDs in the CHU.  Baker said no.  Coombs asked if it would have been OK for Baker to have CDs of music or a CD full of photos of family and friends in the CHU, and Baker said that would have been OK.

Baker than confirmed he was on R&R from Jan 30th through the beginning of March. He believed Manning had returned around the first week of February, but didn’t know for sure.

Coombs reminded Baker of his earlier statement that Manning felt the military wasn’t for him, and asked if Baker thought this might be because he was gay.  Baker wasn’t sure.  At which point Coombs asked if maybe he didn’t know because he and Manning weren’t friends. Baker agreed that was true.

Baker was then permanently dismissed from the pretrial.

Mr. Mark Johnson

10:38 AM The prosecution then called Mark Johnson of the Army Computer Crimes Investigation Unit. Johnson is a contractor for a company called AmManTech [NB: I am not sure I caught the name of “AmTech.” If you have the company name, please email me at rainey@bradleymanning.org. Corrected. HT Nadim Kobeissi]  Johnson is a computer forensic examiner who reports to Shaver.  The prosecution reviewed his background and training in cybercrime and forensics.

Mark Johnson was tasked with examining  the forensic image of the Mac Book Pro belonging to Manning.  He began by checking the hash of the image to ensure the image was correct, then ran anti-virus software. After that, he began by looking for the Internet chat logs with Adrian Lamo and anything related to classified information.
He did find chats that looked like they were with Adrian Lamo.  Johnson looked at the configuration of the chats.

The prosecution then showed an image of the chat lots on the screen. The chat logs on the screen displayed the named “Bradley Manning” and “Adrian Lamo” and the timeframe was indicated as  12:49:17 AM to 12:56:07 AM.  One of the first lines said something about an “Apache Weapons Team.” The screen was removed before I could get more detailed notes.

There was a brief recess at this point.  At 10:45 AM, Daniel Ellsberg stepped forward and placed his hand on Manning’s shoulder and leaned in. He began to introduce himself when two MPs from the back of the room came forward and intervened.  He was taken from the room. After extensive discussion in the courtyard outside the courthouse, and after a journalist intervened on Ellsberg’s behalf, he was allowed to return.

Shortly after, a lunch recess was announced.

At 1:18 PM the media, public, and others were in the room. We waited in the court room until the attorneys and investigating officer returned at 1:41 PM. Presumably, the defense, prosecution and attorneys were meeting together before that.

Almanza called the room to order. He reminded everyone of their obligations to maintain the dignity and decorum of the proceedings by not interrupting and cautioned against cell phones.

Johnson was called back by the prosecution and reminded he was still under oath.  Per questions, Johnsons explained that Adium was an internet chat service that worked with multiple clients. He stated that he had found chat logs stored on Manning’s MacBook between individuals with user name “BradAss87” and “Adrian.”

In the allocated space of the computer, Johnson also found a buddy list associated with the Adium account on Manning’s computer. Here he found contacts that included Adrian, dawgnetwork@jabber.ccc.de, and pressassociation@jabber.ccc.de.  The third email was associated with Julian Assange.
The prosecution pulled up a screen to show the alias associated in the computer. It looked like this:

<name>pressassociation@jabber.ccc.dc</name><alias>Julian Assange</alias>

Johnson testified that in the unallocated space they had found a prior alias for the pressassociation buddy profile – “Nathanial Frank.” The prosecution again showed how this alias was displayed on the screens like this:

<name>pressassociation@jabber.ccc.dc</name><alias>Julian Assange</alias>

Johnson also found a former entry for this buddy in the unallocated space.  It was displayed on the screen as:

<name>pressassociation@jabber.ccc.de</name><alias>Nathanial Frank</alias>

In other words, the account ‘pressassociation’ had been associated with the alias Nathanial Frank, but at some point had been updated to Julian Assange.

Johnson found a large number of chats between Manning’s profile and the pressassociation profile in the unallocated space. They were stored in xml format and many of the chats had to deal with sending and receiving government information.  Johnson did not remember the time frame specifically.

The prosecution then showed a portion of the chat log with pressassociation dated 2010-03-05. I copied down what I could before they removed the slide:

Pressassociation: 5-6 hours for total upload?
Dawgnetwork: uploaded
Dawgnetwork: no, it was like 5 minutes
Dawgnetwork: ping
Dawgnetwork: ping
Dawgnetwork: anyway, should be good to go with that
Dawgnetwork: news?
Dawgnetwork: …
Dawgnetwork: hi
Dawgnetwork: hiya
pressassociation: i like debates.
pressassociation: just finished one on the IMMI, and crushed some wretch from the journalists union
Dawgnetwork: vid?
pressassociation: of this?

[Note: there were a couple lines at the bottom I didn’t have time to transcript before the slide was taken down, but I got most of it.]

[Note: I missed a few spoken sentences here because I was transcribing from the slide, so I am not sure which logs are being referred to in the following paragraph]

Johnson also spoke about logs showing traffic between computers. He specifically mentioned IP address 88.80.17.761 He noted that this IP address was associated with PRQ based in Sweden, which was known to be associated with WikiLeaks.  [I believe PRQ here refers to https://en.wikipedia.org/wiki/PRQ]  Johnson state the logs also noted IP address 72.66.112.117 – associated with Manning’s aunt’s computer.  There was also mention of the URL lain.knack.net

Johnson then testified that he had looked for referenced to the IP address 88.80.17.761 in the unallocated spaces of the Macbook, and he had found references to it.
Additionally, Johnson discovered a number of PGP encrypted emails on Manning’s Thunderbird email.  He found an email exchange with Eric Schmiedl <unlocked@mit.edu> in which a portion was not encrypted. He displayed it on the screen.   Here’s basically what the slide looked like; in the effort to transcribe as quickly as possible, I didn’t include the full email addresses and other address information down:

5/19/10

I was the source of the 12 Jul 07 video of the Apache Weapons team which killed the two journalists and injured two kids.

>> 5/[1]2/10
>>12:46 AM
>>From: Eric Schmiedl
>>Yes I am

>>>>5/11/10
>>>>5:46 PM
>>>>From: Bradley Manning
>>>>Are you familiar with the WikiLeaks?

v/r

Manning, Bradley E.

[Note: I would like to verify the dates on these; my handwriting here was quick. If you copied down the dates, leave a comment below or email rainey@bradleymanning.org.]

In recovering Manning’s laptop, Johnson was also able to gain access to Manning’s private key for decrypting his PGP emails.  However, Johnson did not have the password. In an effort to come up with the password, Johnson tried using the password that they had forensically scraped that allowed a user to log onto the OS 10. The password for logging onto the computer turned out to be the same as the one for decrypting emails.

The password was TWink1492!!

By examining the disc utility log, Johnson was able to see a log of the number of CDs burned and erased.
The prosecution put a slide up on the screen that showed the disc utility log.  The entries in the log began on Feb 27 2010 and ended Mar 9 2010.

Johnson also examined the CD discovered in the CHU that was marked ‘secret.’  He took the file name from this CD and found a similarly-named one in the unallocated space on the Mac.  In particular, Johnson discussed /volumes being a valuable source. He described /volumes as being a “mounting point” – a starting point for a directory.  He searched the /volumes path to see what he could find.

Among the things he discovered was a file named Jul 07 C2 ENGAGEMENT ZONE 30 FC Anyone.wmv

Johnson found other/volumes in the unallocated space.  The prosecution put up a slide showing what was found, but it was unfortunately difficult to red.  In general, it appeared that files discovered in /volumes followed the format of:

/volumes/CD or disc name/Date and time/file name.

Johnson said that this was similar to how Roxio saved file names.

The last disc burned and visible in the disc utility log was May 4, 2010 – it was files.zip.

In the unallocated space Johnson also discovered html formatted files.  On the screen, the prosecution showed an example of these html formatted files. The one displayed was (a nonclassified cable) Cambodia Remains Non Committal on Kosovo, pulled from Net Centric Diplomacy version 8.2.10.

In the unallocated space, Johnson also found other classified cables.  He found about 16,000 unique MRNs in the unallocated space.

On the allocated space, Johnson found CSV files and a PHP script , but did not find Base64 encoded cables. However, Johnson was able to export the PHP script through an alternate boot (running Manning’s hard drive on someone else’s computer). The script, when run, created a CSV file of Embassy cables including MSN data and other data points. The final output of the script would be: Date, time and embassy, a number, the MRN, another number, and additional information.

Johnson also found references to the WikiLeaks upload page in the unallocated spaces, and pulled up an archived copy for audience viewing.  Johnson also found a number of historical status or progress reports.  In particular the upload appeared to have been successful.  He particularly referenced the farah cases as being uploaded. There were four parts to these, and each was

Johnson then described “rar” as being an archive file format not unlike zip.  He said that files ending in .nc were associated with the encryption program mcrypt.  He found references to mcrypt in a file format:

no-openpgp -d -farah.key -a  rijnduel-256 farah.part*.rar.nc

He noted that this was very strong encryption.

He also found references in the unallocated space to a folder o Manning’s desktop that had contained 7 parts to the Farah files.  Johnson used a tool [missed the name of the tool – sounded like “stay harbor”] in order to search for files within files.  He found remnants (now corrupt) of a rar archive. He also found a powerpoint presentation and embedded photographs. The pictures in the powerpoint were also found on the SIPR computers.

He found references to the theft of the Global Address List  in the unallocated space.   Specifically, Johnson found thousands of exchange formatted email addresses in the unallocated space.

Johnson also found a Rich Text Format (RTF) that contained names of Gitmo detainees (also in unallocated space).
He found evidence that the computer had been wiped or reinstalled in January 2010, and that the hard drive had been successfully erased.  The disc utility log was also erased.  There was evidence that on January 31, 2010, there was an attempt to erase the unallocated space. However, the option chosen was a “35 pass erase  free space — a very slow process.  The erasure process was discontinued.  However, because of the erasure that was successful, there were no files available before January.

The prosecution then handed Johnson a series of papers and asked him to identify them for the record. They included screen shots from Manning’s computer, encrypted emails from Manning’s computer, decrypted emails from Manning’s computer, and the keychain from Manning computer.

At this point the prosecution was finished. Cpt. Blouchard of the defense team came forward.

Blouchard began by reviewing Johnson’s certifications. He noted, and Johnson agreed, that prior to the Manning case Johnson had never done forensics on an Apple computer.

On questioning, Johnson noted that Manning’s computer was set to automatically login.  This meant that potentially anyone gain access to it.

Additionally, on questioning Johnson noted that the GAL was not found on Manning’s personal computer.
Johnson also agreed that there was no evidence found of a connection a particular known WikiLeaks associate.  [NB: hard to hear the name of this person - sounded like “Red Buick”?]

Additionally, Johnson could not say who had originally assigned him to work on this project.

When asked to comment on the SCIF security, there was an objection from the prosecution that was sustained.
Blouchard then asked if there was any indication in the materials Johnson reviewed that indicated Gender Identity Disorder. Johnson said he wasn’t able to make those judgements. Similarly, he couldn’t state whether he saw evidence of odd behavior.  He was aware of the alter ego Breanna Manning.

Johnson agreed that user profiles to not equate to a person sitting at a computer.

Johnson was then temporarily dismissed.

David Shaver

2:26 PM  Shaver returned to the stand to discuss the SD card that was taken from Manning’s aunt’s home on the second search of the residence.  Shaver was brought in by the prosecution and reminded he was still under oath.
Shaver imaged and examined the SD card himself.  He verified the hash of the image.

He found in the unallocated space of the SD card over 10,000 CYDNY reports.  He also found a deleted photo of Manning. This was displayed on the screen by the prosecution. It was a self-portrait Manning took with a camera held in one hand, standing in front of a mirror in the basement of his aunt’s house.

In the allocated space of the SD card, there was a file called yada.tar.bz2.nc made on January 30, 2010 at 10:22 PM.
There were two other files on this disc, both of which were unrecoverable and both of which referenced the word “nathan” in the title, i.e. “nathan2_events_tar_bz2”

Within the yada.tar file were 4 files that Shaver was able to successfully decrypt using the password from before. The first was 91,000 CYDNY logs from Afghanistan and the second was about 100,000 CYDNY logs from Iraq. It was displayed on the screen like this:

afg_events.csv                    1/8/10
irq_events.csv                    1/5/10
README                    1/9/10
._README.TXT                    1/9/10

The README file was a text file that described the other files as being from two wars of historical significance. The note specifically stated that steps had been taken to sanitize certain sensitive data, and that there should be a 90-100 day wait before releasing data to best assess how to distribute the information and protect the source. It ended with:

“This is possibly one of the more significant document of our time, removing the fog of war, revealing the true nature of 21st century asymmetric warfare. Have a good day.”

The prosecution then asked Shaver to authenticate several documents, including screenshots from Thunderbird email on 4/10//10 and an email on 4/8/10.

The prosecution finished up and Blouchard came forward to cross examine Shaver.  The cross examination was perfunctory.  In response to questions, Shaver stated that he’d received a search warrant for the SD card in December 2010, he didn’t know who had handled the SD Card before he received it, and he did not know if it had been shipped from Iraq.

Shaver was then temporarily excused.

Mark Johnson

2:39 PM Mark Johnson was recalled to the stand by the prosecution and reminded he was still under oath.  He testified that he had examined an image of Manning’s external hard drive.

On the external hard drive, Johnson found a text file and a powerpoint presentation. The powerpoint presentation showed was on the topic of “Operational Security Briefing” and the listed author was Manning.  The date on the first slide was Friday 13 Jun 08.

The text file was a file named “wl_press.txt”  It was created on 30 Nov 09 at 20:23:29. It listed the contact information for Mr. Julian Assange, including a phone number (354 862 3481) . It stated there was “24 hour service” and suggested asking for Julian Assange.

The prosecution had no more questions on this issue, and the defense declined to cross examine. Johnson was temporarily dismissed.

David Shaver

3:06 PM David Shaver was recalled to the room, reminded he was  still under oath, and reminded not to reveal classified information without informing the judge.

Under questions from the prosecution, Shaver described the Centaur Logs — a new flow log that captures source IP, destination IP, time, date, and packet data like how much data was transferred.

Shaver reviewed Centaur logs associated with the .22 and .40 computers connecting to the CYDNEY data base and the State Department database.

The prosecution showed a slide detailing the Centaur logs that showed traffic communication from the CYDNEY database and State Department database to the computers assigned to Manning.  It showed a 3 month time span in which 11.2 GB of data were passed.

Shaver also examined the Firewall log from the Department of State.  He found a connection between the .22 machine and Net Centric Diplomacy server.  This pattern mimicked patterns found in the previous logs — that certain days had significantly more traffic than others. There was significant activist on 30 March and 28 March, then again on 8 April and 9 April. There were around 800,000 total connections from the .22 machine to the State Department servers from March 7 till the end of May.

Server logs from the State Department also showed that a large number of files had been downloaded by the .22 machine using wget.

The prosecution pulled up a slide that showed these logs. Logs showed the IP address, the date/time, the version of wget (wget 1.11.4) and the action taken. Server logs before May were unavailable due to a problem with the server.

The CentCom Server hosted information about the Farah investigation.  According to Shaver, the investigators were able to get images of the portions of the CentCom servers related to the Farah investigation.  Shaver noted that the folders and files were named in CentCom in the same way as they were named on Manning’s computer.

Notably, CentCom logs do not record external IP address. They do, however, get date, time, and files requested.

According to Cent Com logs, there was one powerpoint presentation that was only ever downloaded one time.  It was downloaded 4/10/10. This file was the same as the one on Manning’s computer. Hundreds of other files were also downloaded at the same time.

Shaver also examined CIA log files.  He examined the Open Source Center for the CIA, where Manning has established an account under the user name BradAss87.  The BradAss87 account had conducted searches for the term Iceland about 30 times and the term WikiLeaks about 30 times as well.

Shaver also examined the CIA World Intelligence Review. (CIAWire)

At this point the prosecution was done questioning. Blouchard rose and asked a few questions of Shaver.  He struggled a bit with the technical aspects.

Under questioning, Shaver stated that he had reviewed Centaur logs from 1 Oct 09 to the end of May 10.  He did not examine all of the SCIP computers.  Shaver noted that there was nothing unauthorized about accessing classified data from a workstation computer.  this was true of the State Department files and the Cent Comm files.  Shaver admitted that there were no password needed to access these servers.  Passwords also didn’t need passwords for CIAWire or Centaur. the persons who operated the .22 and .40 machines had authorization to look at this data.

Blouchard returned to his seat, and one of the prosecuting attorneys stepped up with a follow up question.  Under the questioning, Shaver confirmed that one did need a user account and password to access a SIPR computer.
The prosecuting attorney returned to his seat and Blouchard stood with a follow up question. Per the question, Shaver confirmed that more than one analyst was assigned to the SIPR computers.

At 3:35 PM the court was closed to the press and public, supposedly so the government could prevent classified documents. Even individuals who had top secret security clearance were made to leave.

4:02 PM Shaver was still on the witness stand when the public was allowed back into the court room.  He stated that he had examined the NIPRnet computer, which included a profile for Manning.  He found a number of searches on Google conducted by the Manning profile. Including: wikileaks, base64 and wget.  No classified material was found
On 3 May 10, there was a record of a search for wget in Google, then evidence that wget was downloaded.  The prosecution provided a slide showing a cached version of the wget version 1.11.4 download page.  Shaver testified that this instance of wget – created on the NIPR computer on 3 May 10 – had a hash identical to the hash of the wget instance installed on the .22 machine on 4 May 10. In other words, these were the same exact file.

Shaver noted that wget was available on the .22 computer prior to May 4th.

The prosecution was finished with questioning.  Cpt. Blouchard of the defense team rose. He began by questioning about whether wget was a mission-essential program. The prosecution objected to this line of questioning and Almanza sustained their objections.

Blouchard then asked when there was first evidence of a Farah file on the computer. Shaver stated it was in April 2010.

Blouchard asked if Shaver was aware that WikiLeaks claimed to have that information in January. Shaver was unaware of that.

At 4:10 PM Shaver was dismissed and the court was closed for the day. Then next witness is a soldier in Italy, so we are reconvening tomorrow at 9AM to make an early call.

Resources:
Base64 Encoding https://en.wikipedia.org/wiki/Base64
Mcrypt https://en.wikipedia.org/wiki/Mcrypt
News Coverage

Forensic Examiner Found No Match of Cables on Manning’s Laptop to WikiLeaks’

http://www.wired.com/threatlevel/2011/12/cables-match-laptop-manning/

Prosecutors claim Bradley Manning wanted to remove ‘the fog of war’
http://www.guardian.co.uk/world/2011/dec/19/bradley-manning-emails-wikilieaks-julian-assange?newsfeed=true

Army Lt. Dan Choi Pinned to Ground, Thrown Off Base Before Manning Trial
http://news.firedoglake.com/2011/12/19/army-lt-dan-choi-pinned-to-ground-thrown-off-base-before-manning-trial/

Bradley Manning case: Investigators show evidence of WikiLeaks link, Assange chats

http://www.washingtonpost.com/world/national-security/bradley-manning-case-investigators-show-evidence-of-wikileaks-link-assange-chats/2011/12/19/gIQAcDoS5O_story.html

Bradley Manning pre-trial hearing – Monday 19 December 2011 as it happened

http://www.guardian.co.uk/world/blog/2011/dec/19/bradley-manning-pre-trial-hearing-live-updates

Note: there are a number of proper nouns – from military terms like FOB Hammer to names like Milliman – that may be hard to spell.  Where possible, I am checking my spelling against that of the Associated Press and Kevin Gosztola of Firedoglake. If there are mistakes, please email corrections to rainey@bradleymanning.org.

See day one here.
See day two here.

Getting to the Courtroom

Figuring the crowds would be minimal on the third day of the proceedings and noting that the last two days of the hearing started late, I came in later this morning.  I arrived and shot a picture from my phone of the courthouse, only to be reprimanded by a guard nearby about taking photos. He told me it was a violation of federal law to take a photograph on government property, which surprised me because I had seen dozens of photographers. I decrypted my phone, erased the photo, turned the device off, and put it back in the glove compartment. The officer said he really hoped I wouldn’t do this again as he would hate to have to remove me from the courthouse.

I was searched and denied entrance because court was already in session, which didn’t bother me as the trial had a live real-time feed in the theater building next door for spectators. But as I headed over to watch the beginning of the proceedings from the theater, I was told they were closing the theater down and I would be unable to watch there. They refused me late entrance to the courtroom, closed the theater down even though it prevented me from watching, and refused me entrance to the media center because they said I lacked proper credentials. I found this particularly frustrating because we had two members of the Bradley Manning  Support Network apply for media passes (among other things, people with media access are able to have a laptop and make notes on keyboard instead of by hand).  One pass was never granted. The other was approved, but then subsequently revoked.

I waited out the morning in a heated trailer.  No notes from first witness. I urge people who want to learn about the first witness to visit http://dissenter.firedoglake.com/2011/12/18/bradley-manning-pre-trial-hearing-live-blog-day-3/

The Article 32

11:17 AM. Sergeant First Class Paul Adkins was called by the prosecution. He was a straight-backed individual with wide shoulders and narrow eyes, with thin-rimmed glasses.  No sooner was Adkins sworn in than he invoked his Article 31 right to remain silent.   The investigating officer Almanza asked whether there were any questions he could be asked which would not cause him to invoke his Article 31, and Adkins said there was nowt.

David Coombs stood and objected.  Citing case law, he argued that the Article 31 did not apply in an article 31 hearing. He urged Almanza to force Adkins to testify because he wasn’t under criminal investigation in this matter.  As a secondary measure, the defense urged the Almanza to offer Adkins immunity and then compel him to testify.  The prosecution would not support an immunity offer for Adkins, and the IO dismissed Adkins from the stand.

Kyle Balonek

11:21 AM Warrant Officer 1 Kyle Balonek was called telephonically. As with the previous witness, no sooner was he sworn in than he invoked his right to remain silent.  Once more Almanza asked whether there were any questions that could be asked that would not cause the witness to invoke his Article 31 rights.    Again the defense objected, citing their prior objections and noting as well that this individual wasn’t facing criminal or administrative investigation.  Nonetheless, the government dismissed Balonek, finding him to be unavailable.

 Sergeant Chad Madaras

11:24 AM Sergeant Madaras was sworn in telephonically.  He was reminded not to have any notes in front of him, and told to notify the investigating officer if he wanted to make a classified response.

The prosecution began by asking how Madaras knew Manning.  They met together during a GCC rotation.  Specifically, they met in the smoking area near the barracks during the summer or fall of 2008.  Like Manning, Madaras was a 35 Fox Intelligence Analyst.

The prosecution then reviewed Madaras’ training and credentials, asking him to describe what he had learned in AIT (training to become an analyst).  He described the basic knowledge obtained, and the prosecution wanted to know if the training included details about accessing information or publishing it on the Internet. Madaras could not recall that there was anything in the AIT training about publishing information on the Internet.

Madaras described taking a DCGS class with Manning in August 2008, as well as a military writing style class in which Adkins was the instructor.  He also noted that manning was on a JRCT Iraq rotation with him in 2009.  During the rotation, they did not work the same shift. At the time, Manning worked the day shift and Madaras worked nights.

Madaras described being deployed to Iraq in October 2009, with Manning coming a few weeks later. They both worked in the same place, and on the same team – The Shia Threat Team. At first, Madaras worked the day shift and Manning worked the evening. At some point later, that switched. During this time, Madaras and Manning shared a work station and two computers – one referred to as a Dell and one an Alienware. At first, they both used the Dell, but then Manning increasingly used the Alienware computer.

As an analyst, Madaras was charged with reading reports and trying to link together any targets that might be working together. The day shift did a bulk of the work, and then tasks that weren’t completed were passed on to the night shift. The prosecution asked if Manning had completed his assigned tasks, and Madaras replied that “Majority of the time, ma’am, no they were not completed.”

The prosecution asked Madaras about whether he can conducted searches using the keywords WikiLeaks, Iceland, Central Command SJA, Julian Assange, retentions, Birgitta Jonsdottir, or Reykjavik. Madaras responded no to each.  The prosecution asked is Madaras had used Intellipedia (he had), and whether he had used Intellipedia to search information on the Gitmo database, Net Centric diplomacy, CEDNY, or WGet.  He replied no to each.

Madaras testified that he never used Manning’s user profile and didn’t know Manning’s passwords. When asked if his computer ever acted out of the ordinary, Madaras replied affirmatively, stating it happened all the time.  He said the computer crashed a lot and had consistent problems. When that happened, they’d get help from someone else [Note: missed the name here, though subsequent testimony makes this pretty clear it is Milliman] would try to get it working again.

At this point the prosecution had no more questions and Coombs took over. He stepped up the speaker phone of the telephone, noting that he was sorry that the witness was not there in person.  Coombs began by reviewing the historical facts – that Manning and Madaras met in 2008 in the smoking area by the barracks.  Asked in Manning was interested in politics, Madaras said yes and related that Manning often would talk about a previous job in which he had opportunity to meet politicians in passing.

Upon questioning, Madaras admitted that he wasn’t really a computer guy.  He didn’t remember any training about not placing executable files on the desktop.

Madaras stated that he arrived at FOB Hammer on October 15^th.  At that time, Sergeant Pagent was serving as the supervisor (there was no commissioned officer available).  The way the workload was set up, the day shift was tasked to complete work in a day, and anything they didn’t finish was given to the night shift. According to Madaras, sometimes Manning did the work left to him and sometimes he did not. But some of the time, the work Manning did was great.  Madaras said he didn’t really know if work was being given to Manning on the sign.

Coombs asked Madaras if he knew Manning was suffering from any issues. Madaras said no, though he was aware of the emotional outbursts Manning had experienced.  For example, Madaras knew about an event in December 09 or January 2010 in which Adkins had asked Manning to move a projector. Manning had gotten upset, slammed a chair, and charged in to the area. Adkins intervened and tried to calm him down and took him outside.  Coombs asked whether this was acceptable behavior, and Madaras said it was not. Coombs asked if there had been disciplinary action or if Manning had been removed from his station, and Madaras was not aware of any such disciplinary action.

Madaras also admitted that he’d seen Manning slam various items onto his work station, and noted that this was also not acceptable but also had not resulted in disciplinary action.

Coombs asked if Madaras had ever seen Manning act in a nonresponsive way. Madaras then described how Manning would sometimes sit and stare at his computer screen, even when Adkins and Balonik would call his name and try to get his attention.

Coombs then asked Madaras if he was ever afraid that Manning would hurt himself or others. Madaras said he was not, but that others in the unit had expressed that concern.  When asked if Manning had friends, Madaras said that he’s seen one person (Sadler?) speak to Manning a few times, but that he didn’t really have friends.  When asked if soldiers picked on Manning, Madaras said that they didn’t really but that sometimes they’d make fun of him a bit. Especially at night, when Manning would be running around and people would make comments on it.

At this point, the prosecution objected.  David Coombs strongly urged Almanza not to sustain the objection, stating that in the pretrial hearing the defense had broad latitude to cross examine witnesses and were allowed to engage in discovery.

In a soft, almost inaudible response, Almanza overruled the objection.

Coombs continued on, asking Madaras whether Manning was an outcast.  Madaras said yes. As to whether he was picked on, Madaras wasn’t sure.

Madaras then commented on the state of information security. He stated that soldiers listened to music on in the SCIF.  He said that music was on the shared drive that had been passed down to them, and that it was accessible on computers. He said that there were also video games on the computers, and movies that could be played by DVD player.

Madaras testified that the DCIGs machines would crash when there was too much stuff saved on the desktop, and he mentioned that when the DCIGs were slow Manning would sometimes try to fix them.

Madaras also mentioned that Manning had put MercmIRC-Chat on their computer.  MercmIRC Chat was a program that Madaras needed for his job.  Manning helped other to put it on their computers.  Madaras said that he did not know how to add mission-critical programs to the desktop himself.

At this point Coombs sat down. The prosecution stepped up to ask whether Manning had signed a non-disclosure agreement, which Madaras said he had.

Madaras was then permanently excused from the pretrial hearing, and the hearing was recessed for lunch. It was 11:54 AM.

Allen Milliman

At 1:35 PM the defense called Allen Milliman, who appeared telephonically.  He was sworn in, warned against referring to notes, and warned against disclosing classified information without first informing the IP.

The prosecution began by reviewing Milliman’s history, including training and military background.  Milliman is a network engineer for Task, Inc. He served in the military for 21 years as a 33 Tango (Electronic repairs) and a 72 echo (Combat telecom).  He retired on 8/31/05 and has since been a contractor for a series of companies.  Milliman was deployed as a civilian in Iraq from 11/28/09-12/19/10.  He was in FOB Hammer from July 2009 till the following year. His primary responsibility was as a Field Software Engineer (FSE). He helped maintain the DCGS (Distributed Common Ground Systems).

Milliman had to maintain the laptops and the servers, but mostly focused on the laptops.  FSEs and Mentors handled the software on the computers, but FSEs handled the hardware, reloading of software, and firmware. He described his role as a technical assistant- intervening when computers had problems, swapping out hard drives that couldn’t be repaired. He remembered Manning as someone he saw daily but interacted with little, perhaps in passing one or two times per week. Sgt. Madaras he saw a similar amount, interacting with 3-5 times per week.

When asked whether he spent a lot of time repairing Manning and Madaras’ computer, he said yes — theirs seemed to be the one that had the most issues.  Their computer issued occurred with greater frequency that others’.

Milliman didn’t remember the first time he met Manning, and he recalled that Manning had stated he had a computer repair business of his own at one point.  He also said that Manning had once told him that if people really knew what he [Manning] could do with a computer, they’d be amazed.

Asked about WGET, Milliman said he was familiar with the name but had never used it and didn’t think it was authorized but wasn’t sure.  When asked about how to ascertain whether a program was authorized, Milliman stated “there was a list that was supposedly available online but I could never find it.”

Asked about MercmIRC-Chat, Milliman stated that it wasn’t standard but that it could be authorized and allowed.  It could be installed by people on their desktops, though they weren’t supposed to do that.

At this point, the prosecution had no more questions. Coombs stepped up to speak to the speaker phone.  As he had with previous telephonic witnesses, Coombs noted how much he wished Milliman were in the court in person.

Coombs reviewed Milliman’s historical data. He retired in 2005 as an E7 and worked on DCIGs.  Milliman noted that heat was a major problem with DCIGs, as was dust. He described field solutions to combating dust and heat, and noted that the computers were particularly prone to crashing prior to these solutions being implemented.  He also agreed that a computer could crash due to problems on the hard drive or graphics card.

Milliman explained that there were often many profiles on a DCIG machine, sometimes as many as 12.  He noted that if you had a lot saved on your desktop, the profile would have issues. There would also be problems if you had a lot of emails on your hard drive, or if you were storing redundant files, or potentially if the hard drive became fragmented.

When it crashed, the data was sometimes recoverable, but sometimes not.

Milliman purchased with a Universal Drive Adapter with his own funds to assist with data recovery.

If someone wanted to add something to their computer, they were supposed to get approved.  There was a chain of command from which he was supposed to request permission. He didn’t know who was in the chain of command above him, but he didn’t speak to any military personnel.  It would take a couple days to get approval.

He described MercmIRC-chat as being instant messaging software.  He said there was one version of MercmIRC-Chat that didn’t play well with the antivirus software on the computers.

When asked whether the chain of command had ever rejected a request for a program, he said it happened once but he couldn’t remember the details.  He also noted that it was possible for individuals to add programs directly to the desktop without administration rights.  They could in fact save executable files to the desktop.  He stated that people felt the DCIGs were their machines to do with as they pleased.  Milliman stated that people could have added programs to their desktops but he was pretty sure he would have noticed it.

When asked if he’s seen WGET on a desktop, Milliman could not recall. When asked whether the computers could have been configured in a way that prevented them from being able to save executable files on the desktop, Milliman said they could.  He also noted that he was there as a contractor to assist the solders, and thus it was implied that he was not a reprimander.

Coombs ended his questions and the prosecution stepped up with a few follow-up issues.  They asked if programs could be run from a disc, which Milliman said they could. They asked if Milliman had installed WGet onto Manning’s computer, which he had not.  He also clarified the role of a Mentor, someone who was a subject matter expert in ARC- GIS.

Milliman was then permanently excused.

Cpt. Thomas Cherepko

At 2:25 PM, the prosecution called Captain Thomas Cherepko.  He also testified by phone.  After being sworn in and confirming he was in a place with privacy, they reminded him not to refer to notes or disclose classified information with first telling the IO.

He was currently a Deputy CIS officer for NATO, serving in the Information Systems Manager branch.  Cherepko has been in the army for 16 years.  He had served as an automation officer since summer 2009, and before that as an engineer officer. The prosecution then reviewed his training.

He was deployed to Iraq three times – 2005, 2006-08, 2009-10.  In his last stint, Cherepko served at the FOB Hammer in Baghdad with the brigade headquarters.  He arrived in FOB Hammer in mid November 2009.  After arrival, he served as Brigade Automations Officer overseeing NIPRnet and SIPRnet.  The NIPRnet was an unclassified network that allowed you to access the worldwide web.  The SIPRnet was a global intranet for the Department of Defense that included materials classified up to Secret. To get a SIPRnet account, you needed the approval of your first line supervisor, you had to complete paperwork, you had to complete an online training, and you needed appropriate security clearance.

There was also an Acceptable Use Policy (ACP) that everyone who got on SIPRnet had to read, review and sign explaining what one could and couldn’t do on SIPRnet. The online training was a Department of Defense created Information Assurance Training. It explained security best practices and stated that you weren’t authorized to share password, though Cherepko did not recall if it said anything about classified information specifically.

The administrators were Cherepko and several of his soldiers. They were charged with monitoring, maintaining and upkeep of networking security practices.  He stated that soldiers are not allowed to install programs on 210 Mountain SIPRNet Systems. WGet was not authorized to be installed by a systems administrator. Cherepko stated that, to his knowledge, WGet was not approved by the DOD.

MercmIRC-Chat was operationally necessary.  Cherepko believed it was authorized to be on the network, and noted it was there when he arrived and was part of the base system.

About the Acceptable Use Policy (AUP), Cherepko wasn’t sure whether individuals signed it before they were deployed.  But he did believe that he had an obligation to maintain signed AVPs.  However, he admitted that he did not maintain Manning’s AVP because they could not find it when he was asked to produce it. And, in fact, he could not find his own either.  He explained that there were over 2,000 users and that the AUPs were paper copies kept in file folders, and “it [Manning’s AUP] was just misplaced.”

Cherepko explained that they had a shared drive known as the T drive that was about 11 terabytes of data.  It was classified as Secret and accessible to anyone on the SIPRnet who had been given access.  It was inherited from several prior brigades.

Cherepko admitted there was music and movies on the shared drive.  He also noted that there was nothing technical preventing a user from removing things from the shared drive and putting it on his SIPR computer.  “You could move it back and forth at will,” he stated. There were also no technical restrictions from burning a CD with classified information.

The prosecution had no further questions at the time, so the defense stepped in.

At 2:48 PM David Coombs stepped up to the speaker phone and verified that the witness could hear him.  The witness said that he could, and asked if Coombs could hear him.  Coombs joked that “You sound like a Sprint commercial” – another light admonishment at the failure of the courts to provide the witnesses in person.

Coombs reviewed the historical facts covered by the prosecution about Cherepko’s job and timeline. Cherepko’s position was to establish, manage and maintain the digital communications. His daily routine included checking the backups, checking his email, checking in with the soldiers at the help desk, and then moving on to trouble shooting the network.

To prepare for his position, Cherepko tool a course called Functional Area 53.  This focused on the technical aspect of running a network. Cherepko admitted he wished that he had a course that was more focused on the army-specific way of doing things.  Coombs asked if Cherepko remembered saying about the training he received in a sworn statement on January 6, 2011 that “we were given just enough knowledge to screw things up.”Cherepko balked slightly at confirming it, though I believe he ultimately did say he could have said that.  Coombs responded that “If you were here in person I would show you your sworn statement.”

Cherepko arrived in FOB Hammer around November 14^th, and he immediately served as Information Assurance Manager (IAM). He didn’t remember when exactly he was made IAM, but stated that for all intents and purposes it was from day one of arriving at FOB Hammer. He was tasked with ensuring training was conducted and procedures were followed, but admitted that he had called for no additional training outside of his own solders.

Coombs asked Cherepko if he was tasked with ensuring that all computers were properly certified and accredited.  Cherepko responded that he wasn’t sure is that was his responsibly.

Asked whether the computers at FOB Hammer with properly certified and accredited, Cherepko paused and stated that it was a “tricky question.” He personally believed they were fine. But he had been told that this was not the case.

Upon questioning, Cherepko stated he had never heard of a DIACAP package. He had never conducted one or submitted one.

Cherepko also admitted that he had received a letter of admonishment in March 2011 for failing to ensure the network was properly accreted and certified.

Cherepko stated that he did go to the SCIF. He stated that he had never asked for a Deputy of the Army Inspector General (DAIG) Inspection. Speaking slowly, he stated under questioning that such inspections were part of his job.  However he wasn’t able to say with 100% assurance that the Theater SCIF was ever inspected.  He testified that no SCIF information security officer was assigned, and he did not know what a T-SCIF special security representative was.

Cherepko knew that people had music and that they kept it in their files. It was on the T-Drive even though it was not authorized. Cherepko state that when he saw music, he would delete it, but that it would come back. He could not recall anyone being punished for this. He also had never recommended anyone for punishment over this, though he had informed his supervisors. In addition to music, he saw games and movies.

Cherepko knew that having music, movies and games violated the Authorized Use Policy.  He had seen programs being added to the T-Drive, including games, and he had notified his supervisors.  He was unaware of any action being taken based on these concerns, and the practices continued until they were redeployed.

In regards to whether he would characterize the situation as undisciplined, Cherepko stated he had no basis of experience by which to judge whether it was undisciplined or disciplined.  He noted that no one had ever been disciplined for violating the policies.

He stated that if someone wanted to add a program to DCIGs, they were supposed to take it to the help desk or they could run it from their desktop, the shared drive, or a removable disc.  During the deployment, there was no written guidance provided about running executable files on a computer.  And in fact, the training was being violated on a daily basis.

When asked what he would do if he found an executable file on a computer, Cherepko struggled to answer. His breathing was audible over the phone and there was a prolonged pause.  Asked what to do if someone wanted authorization to run a mission-essential program, how that program would be approved, Cherepko was not sure.  He stated that he didn’t think he’d ever done it, but that it wasn’t a quick process. He also noted that authorization would only be for a single version of a program, and that as the versions changed it would require new authorization.

Cherepko was then asked whether he had received an executable file from CID. He confirmed that he had.  He confirmed he had used it.  But when asked whether the program was approved, he admitted he didn’t know.

On questioning, Cherepko stated he had not seen unauthorized executable files on the shared drive. He admitted that it would not be hard to find them if he was looking.

If a Derog (Derogatory Report) was filed on someone and the S6 was asked to remove that individuals access to SIPRNet, Cherepko stated it could be accomplished in under one minute.

Cherepko had pushed the unit toward using username and passwords for accounts, instead of role-based log ins.  When asked why the machines had so many user accounts on them, he explained that every time a user logged into a machine it created a cached account for that user.

Cherepko was notified of Manning’s arrest the day it occurred.  He spoke to several CID agents. Upon request, he provided them with server logs from the network and shared drive as well as email logs. Cherepko was able to get some of the requested logs but not all of them. Some of them they did not maintain.  He explained that they only maintained generic server logs for troubleshooting purposes.

Cherepko stated that the CID agents had asked him to create images of a computer and, after some concern, he tasked one of his solders with doing the imaging (either Sgt Joseph Benthal or Private Dodley; he didn’t remember which.).  He believed a supply sergeant’s computer was imaged but couldn’t remember if additional devices were imaged as well.

Cherepko stated he was concerned about his ability to create forensically sound images.  He had expressed this concern to the CID agent, and the agent had responded (basically) that it was OK because the devices hadn’t been seized yet and it’s already been so long that they are already tainted.

Cherepko was also asked to make a copy of Manning’s log file and folder.  He didn’t remember who asked, but he received tutoring in doing it.  (Specifically, how to maintain the metadata.)  Then the CID agent sent him an executable program.  Cherepko noted that the copy he made was from the day he copied it, not on a prior version.

Coombs then returned to his seat and the government stepped up to resume questioning Cherepko. The phone line was disconnected and there were brief technical issues reestablishing connection. When Cherepko was back, the government asked for more information about what the log data contained.  Cherepko was not sure.  The government also asked what happened to his automation system after Manning’s arrest. Cherepko said there was no immediate effect on the network but in the coming weeks they had a session on how to prevent such a thin from happening again.

No sooner had the prosecution resumed its seat than Coombs stood. Upon questioning, Cherepko stated that after Manning’s arrest he had met with his Executive Officer and others to create a corrective training regarding Derogs for soldiers.

Cherepko was then permanently excused and there was a brief recess.

Public Pushed Out, “Relevant Government Agencies” May Stay

3:48 PM We reconvened briefly for and Almanza reviewed the decorum procedures for the courtroom.  Then the prosecutor requested to have a closed hearing.  The public and media were excused, but the defense, prosecution, and “relevant government agencies” were allowed to stay.  I suspect this may refer to the individuals who are sitting on the right side of the court room, in the second row behind the prosecution. None of them have identified themselves. I do not know what agency those individuals are with, but they were allowed to stay while the public was forced out.

It is worth noting that even individuals with a secret security clearance were not allowed to remain in the room.

We headed out to the heated trailer to wait on folding chairs and chat. Those who smoked lit their cigarettes from one another, as lighters were not allowed and people were guarded with their matches.

Closed Hearing Over Defense Objections

5:42 PM

The court was called back into order. The video link to the media room was restored. Almanza seemed to be deteriorating a bit, he had a coughing fit while explaining his decision.
Almanza stated that, after discussing it in the closed session, he had decided to allow a closed hearing for a portion of the next day.  He found that the information had been properly classified and that the need to maintain that classification outweighed the value of a public and open trial.  He said that there was no lesser means appropriate to ensure the confidentiality of the classified documents than to close the trial.

Coombs stood and stated his objection to a closed trial for the record.  It was noted.

Special Agent David Shaver

The government then called Special Agent David Shaver of the Computer Crimes Investigative Unit. He was sworn in and reminded of the classification rules.  Agent Shaver had been with the army since 1999 and specialized in investigating intrusions into any computer worldwide.

Shaver stated he relied heavily on EnCase for forensic analysis and said he was competent with Windows, UNIX, Linux, and Mac.  They reviewed his experience, including his publications and awards.

Shaver became involved in the Manning hearing in either late May or early June 2010 when CCIU was assigned to the case. He examined two SIPR computers – Manning’s primary computer (which he referred to as the .22 – likely referencing the IP address) and secondary computer.  Both has Manning profiles on them but the primary one – the Windows Alienware – was used more often.

Shaver began by explaining IP addresses as being like telephone numbers, and explained that IntelLink was similar to Google. He spoke in rapid-fire statement, punctuated every few words with “sir”.  Shaver examined the Intel Link logs from October 2009-May 2010. He focused on keyword searched, the hits they received, files downloaded and accessed.  His investigative plan was to look for keywords, which he did by searching for unique strings within the log file.  He was able to verify what he did by conducting searches on his own computer, then comparing the unique log file he created to the one he was searching for in the IntelLink logs.

He moved the data he collected into Excel spreadsheets.

In the course of his forensic analysis, he found numerous things out of place. He found searches in IntelLink work the keywords WikiLeaks, Julian Assange, and Iceland.  WikiLeaks searches associated with IP address 22.225.41.40 were shown on a screen to the investigating officer, the search queries ranging from 1 Dec 2009 to 08 Mar 2010.  There were over 100 searches conducted for the search term WikiLeaks. I noted that one of the searched was for ilr+Wikileaks

Shaver also showed search queries or the term Iceland on the screen, beginning 9 January 2010 and ending 21 April 2010.  These were associated with the IP address 22.225.41.22.

The next slide displayed 8 search logs around for information related to “retention of interrogation video.” These were associated with the IP address 22.225.41.40 and began on 28 November 09 and ended 17 January 2010.

Shaver explained that WGet was a command line utility to download files from the Internet.  [NB Shaver mentioned the version number of WGet more than once. If you got it, please let me know by emailing rainey@bradleymanning.org I think it was 1.11.4 but I wasn’t sure] He explained what a command line utility was, and the investigating officer asked if it was sort of like DOS? He said yes.

Shaver explained that you could create a script around WGet in order to automate a process to download a large amount of files.

Shaver stated the first use of WGet was in early March 2010.  From the displayed screen, it appeared that the date was 07 March 2010.  This instance of WGet seemed to be to access the Gitmo detainee assessments.  The forensic examiner was able to recreate the script and download Gitmo detainee logs. The forensic unit then downloaded the Gitmo logs published by WikiLeaks and compared them to what they pulled via WGet. According to Shaver, they matched.

Shaver then explained forensic analysis and how one can verify a hash of data.  He explained that the hash values of the imaged data matched that of the .22 device.

He then mentioned again how he relied on EnCase as a primary tool for forensic analysis.  He used it to search allocated and unallocated spaces (such as deleted files).

Shaver began his analysis by looking for things mentioned in the chat logs, as he had been provided those.

In the allocated spaces

In the allocated spaces on the .22 computer under Manning’s user profile, Shaver found 4 complete Gitmo detainee assessments.  He noted that there were two installed browsers:

• Internet Explorer, which was configured in a way that prevented a user from deleting history and created a log of all files that were opened
• Firefox, which was configured to start in private browsing mode, maintain no Internet history and had IntelLink as its homepage

He also found in My Documents a “files.zip” that had approximately 10,000 state department cables in html format.

At this point, there was supposed to be a slide presentation to show the investigating officer. However, apparently the unclassified materials that the prosecution wanted to show were mistakenly marked as classified and the prosecution thus did not want to show them in an open courtroom. The prosecution offered to show them to the IO, Manning and Manning’s attorney is Manning and his attorney would sit in the jury box and review them. Coombs objected so the presentation proceeded without visual aid.

Shaver also found an excel spreadsheet with three tabs called backup.xls.  The contents were as follows:

• First tab: labeled “WGet” This was a two-column spreadsheet. The first column had a list of 10,000 Message Record Numbers for State Department cables. The second column was the command line to download each of the cables in column one.
• Second tab: labeled “0310-0410” a list of Message Record Numbers for State Department Cables published between March 2010 and April 2010.  Notable, in the top left was the sequence “251,288.” Shaver noted that this was only one number off from the total number of cables released by Wikileaks – 251,287.
• Third tab: labeled “0510” MRN numbers, embassy information, classification type for all the cables.

Shaver noted that the file had been partially corrupted but that it was able to be opened.

Shaver also found WGet in several spots in the PreFetch Folder.  He postulated that one might want to run WGet from various locations within a profile, and multiple versions at the same time, in order to download more quickly.  He noted that WGet was added on 4 May 2010 but that he had found an earlier version in Windows PreFetch.

He also found two CSV files, each with 100 cables in them, in Windows Temp.

In the unallocated spaces

In the unallocated spaces, Shaver found thousands of complete cables ranging in classification and many incomplete ones.

He also founds hundreds of Internment Serial Numbers (ISN) in the Index.dat file.

He found a copy of Collateral Murder as it was released on the WikiLeaks website and also what appeared to be the source file.  The first instance of this was March (found through restore points using EnCase).

He noted that the computer was reimaged in March.

He also found hundreds of files related to the Granai airstrike, including deleted PDFs and Jpegs

He found on 20 May 2009 a large number of files were downloaded and then compiled into a .zip.  These included Jpeg images, such as presentations and documents from hospital burn victims.

At 6:30 PM, per the recommendation of the defense, we adjourned. We’re starting back up again tomorrow at 9AM, beginning with Coombs’ cross-examination of Shaver.

Resources:

DIACAP audit http://www.infosecinc.com/dod-diacap-assessment.html

CCIU http://www.cid.army.mil/cciu.html

News Coverage
Manning Sent ‘Collateral Murder’ Video Links to Commanding Officer

http://www.wired.com/threatlevel/2011/12/manning-apache-video/

Key witness excused from testifying in U.S. leaks case

http://www.reuters.com/article/2011/12/18/us-usa-defense-manning-idUSTRE7BF0D720111218

Files on Manning’s computer linked to WikiLeaks site

http://www.reuters.com/article/2011/12/19/us-usa-defense-manning-idUSTRE7BF0D720111219

See day one here.

Getting to the Courtroom

Fort Meade, Maryland Today was just as chilly and grey as the yesterday, about what you would expect for December in Maryland. The hearing was scheduled to being at 10:00 AM and I arrive a bit after 9:15 AM.  Knowing that the majority of the Manning supporters would likely be drawn to the rally outside the gates, I assumed (correctly) that it would not be difficult to get entrance.  I was right; I was able to get into the courtroom and there was room to spare. As yesterday, our bags were searched and we went through metal detectors.

The military police have designated a heated trailer with folding chairs for us to wait in during breaks.  Today, they added a folding table, more chairs, and two water coolers with cups.

The Article 32

10:34 AM Bradley Manning entered with David Coombs and his two military-assigned attorneys.  When the investigating officer, Lt. Col. Paul Almanza, arrived, he appeared to be chewing something (maybe a lozenge?).  The IO reviewed the court room rules again, advising the spectators not the interrupt or have cellular phones or they could be subject to removal.

Almanza then began by asking Manning’s two military-appointed JAGs, Blouchard and Kemkes, whether they were both certified by military law and authorized to represent Bradley Manning.  Blouchard and Kemkes confirmed they were.

Special Agent Toni Graham

Things moved much more quickly on day two of the pretrial hearing.  The government called their first witness, Special Agent Toni Graham. S.A. Graham was in Hawaii, and unfortunately the connection was not ideal.  The government spent time fiddling with the podium equipment in an attempt to call her, then pulled in a young military support technician with ear studs to help fix the issue.  When at last Graham was on the phone, the connection was static-filled and her voice was nearly incomprehensible.  She was asked to stand and raise her right hand, then swear to tell the truth, and then warned that if she needed to disclose sensitive information that she should note that and wait before making the disclosure.

Her confirmation was hard to understand at best.  Media representatives and public spectators (myself among them) exchanged incredulous looks at the technical difficulties.  Almanza interrupted, stating that he was having difficulty understand her response to a question.  He asked whether she was on a cell phone or a land line, and Graham admitted she was on a cell phone but offered to move to her office so she could talk from a landline.  The defense urged the court to ensure that Graham was in a place where she would be able to speak freely.

A recess was called, mere minutes after the hearing began, so Graham could make the thirty minute trip to her office line.

11:30 AM  Everyone returned to their places, and Almanza quizzed the government about whether the technical difficulties were addressed. The lead attorney for the government, perhaps a bit chagrined, stated that the issue was resolved and it had been a problem with the courtroom connection.  However, they’d switched to a different phone and had already called the first 2 witnesses to check the audio quality.

Toni Graham was again introduced and sworn in.  Her position in the 102^nd Military Police detachment was reviewed, and she stated she was in a place she could speak privately and with freedom. She admitted to having the AIR she had produced (ref number 00000184-190) on hand, but agreed upon defense request to set it aside and notify the court if she needed to refer to it.

Graham was a CID (criminal investigations) agent.  In the Manning case, her primary duties were to protect, collect, and preserve digital device evidence.  The prosecution asked her about her experience, and she said she worked on perhaps 100 cases per year. She was serving on a battalion in Baghdad on 27 May 2010 when she received instructions from her headquarters based on information from a confidential informant.  She then received a search warrant from a military magistrate and developed a team, including Thomas Smith, a counter intelligence agent, and another individual.

Graham was charged with collecting the personal computer and additional digital devices related to the Bradley Manning investigation. She also canvassed acquaintances and collected his personal, SCIF computers, and 2 SIPR computers.

Graham also searched the Containerized Housing Unit (CHU) where Manning resided.  She took a personal computer, hard drive, cell phone, 10 DVDs, and 1 CD marked with the word “secret: in a U.S. postal shipping package. She testified that there were perhaps 100 yards between the SCIF and CHU.  She also took digital devices from the supply section, since she learned Manning had recently been reassigned to supplies.  From the supply area she took another SIPR computer and one other computer. She also obtained a computer belonging to a Captain Bigalow, as allegedly Manning had used this computer. She also found out that Manning had used a secret scanner on two occasions, and so she collected that computer.

Graham testified that she’d received authorization to seize and search the devices via her commander, as well as with consent from Bigalow, and also through formal search authorization granted to her.

On June 11, 2010, the investigation was transferred to the Computer Crimes Investigating Unit (CCIU). That is because CCIU has additional technical expertise, and all of the evidence in this matter was computer-related.  Graham described the evidence being moved to CCIU through a “controlled transfer” – physical evidence hand delivered and additional evidence sent via registered mail.   Evidence was thus hand delivered to Kuwait, then to Virginia.

At this point the prosecution rested and defense attorney Major Matthew Kemkes stepped forward.  Kemkes has a respectful, somewhat solemn, strikingly earnest style in his courtroom delivery.  He came across as thoughtful, and seemed somehow more restrained than Coombs.

Kemkes began by asking Graham if she was the first lead agent in the investigation, which she confirmed.   He then noted that it seemed she was a truly central figure in the investigation, since she was serving now as the government first witness.  He asked whether she had been asked to attend the proceedings in person, and why she had not done so.  She responded that she was in Hawaii and needed to seek approval in order to travel for the proceedings.

At this point Almanza halted the line of questioning, his voice hoarse, and asked about the purpose of this questioning.  Kemkes replied with candor, reiterating earlier defense arguments about the need to have important witnesses on site for the proceedings for in-person cross-examination.  Almanza was unconvinced, referring to his early finding about this issue.

Kemkes proceeded quickly.  After a quick review of her credentials and history, Kemkes confirmed with Graham that she had received search authorization from a military magistrate before searching the CHU.  He asked whether she had signed the 5/29/10 affidavit which stated that Bradley Manning had sent classified documents to outside sources and would share more.  Graham responded that she had indeed signed the affidavit, and in fact had reviewed it recently (within the last 2 weeks).  She confirmed that the affidavit did state the Manning had released TS-SCI information and cables onto the Internet.  Upon questioning, she admitted that much of her affidavit was based on information from commanders at Ft. Belvoir who had received intelligence from a confidential informant. The affidavit also specifically mentioned an article in the Stars and Stripes military publication called “A Wiki for a World of Secrets.”

Kemkes was methodical in questioning the contents of the affidavit Graham provided.  But he was quickly able to hone in on her primary reason for filing the affidavit: because she knew that the Apache helicopter video showing Reuters journalists was confidential information and that millions (5 million? 5 billion? she asked) of “unauthorized individuals” had viewed this document. She did mention that “There were other reasons that I did not provide in the affidavit,” but admitted that the primary ones were those listed in the affidavit itself, especially the release of the Apache helicopter video.

Kemkes asked whether Graham stood by the affidavit she signed, and she confirmed, stating that TS/SCI had been leaked onto the Internet.

Kemkes then asked how she would feel if she found out that the video in question was unclassified, if in fact the 8 million people who saw it had seen an unclassified video.  Graham struggled to answer this question, and was skeptical of Kemkes’ assertion that the video was unclassified.  Kemkes asked how Graham has heard that the video was classified when she filed her affidavit, and Graham said the information had come by way of the confidential informant

Kemkes then picked apart another statement Graham made in her affidavit. He noted that her affidavit stated Manning had been penetrating .mil and .gov accounts for over a year.  Kemkes pointed out that the affidavit was produced in May 2010, and that Manning had only been deployed since November 2009.  How, then, could Graham be sure that he was penetrating systems for over a year?

“I can’t say for sure he was going it for over a year,” Graham admitted.  This information was also something she had gathered by way of the confidential informant’s report.

Kemkes asked Graham about a box containing DVDs she had collected on 7/12/09, including one disc labeled “secret.”  He proceeded to ask about whether she had searched and inventoried other items beyond digital media? She said she had not.  He asked whether she knew that Manning might have gender identity disorder, and she said in fact she had.  Kemkes asked whether Graham has discovered any evidence about this issue when collecting evidence for the case. She could not recall. He asked if she had found anything like that, including medical pamphlets or articles printed from the Internet. She could not recall.  Kemkes asked about a specific medical pamphlet from Canada that reviewed options for dealing with gender identity disorder, including changing one’s dress, hormone therapy, facial surgery, and gender reassignment. Graham again could not recall.

At this point the prosecution objected, asking for the relevance of the questioning. The objection was overruled.

Upon further questioning, Graham admitted that she had seen “several things about homosexuality” when collecting evidence from Manning’s CHU.  Kemkes asked what Graham had done with these things.  Graham replied “I left it in his room.”  Kemkes now asked a few incredulous questions, asking how often she had encountered similar situations where soldiers had copies of Flight Into Hypermasculinity. Almanza admonished Kemkes, urging him to “try to focus on the thoroughness of the investigation.”

Asked again what she did with evidence about Manning’s sexuality, Graham said she “set it to the side.”  She then said plainly that “we already knew before we arrived” that Manning was a homosexual.  She added, awkwardly, “I don’t know if the proper term is transvestite.” [NB: based on the context, I don’t believe Graham was confused about the difference between a transvestite and a homosexual. Rather, I believe she was certain Manning was gay but uncertain whether other factors might also make him a transvestite. She might also have been searching for the word “transgender.”]

Graham explained that in the course of her evidence collection she had conducted 5 interviews and canvassed other people who knew Manning. All interviews were conducted face to face. Kemkes asked if she would agree that Manning didn’t have a lot of friends in the unit.  Graham agreed.  She was asked about his relative popularity, but the prosecution objected.

Kemkes defended his questioning to the IO, stating that these all helped better understand that situation and stating that “what is going on in my client’s mind is very important.”

Kemkes asked whether there was a belief noted in the interviews that Manning was gay.  Graham said no, that it was not brought up.  There was no mention in these interviews of behavioral issues or mental disturbance.

Kemkes noted that Graham’s affidavit was that major piece of documentation affecting the pre-trial confinement hearing of Bradley Manning.  He asked Graham if she was now comfortable with that affidavit being the basis of his pretrial confinement. She statement merely “That was the information I had at the time.”

Here Kemkes stepped away from the speaker phone for the telephone next to the IO and briefly conferred with the defense team. At last he sat down, and the government stepped up for a brief round of questioning before the group broke for recess.

The government stepped up for a quick line of questioning, following an argument pattern the government seems keen to identify: that procedures were appropriately followed. The government asked whether, at the time Graham signed her affidavit, she as aware that TS/SCI information had been compromised. She said she was. [NB: a section of this questioning is unclear from my notes. Apologies.] She briefly discussed the confidential informant who provided them with information, noting that he was in direct contact with the FBI.

The government asked Graham whether there was evidence to suggest that the Apache airstrike video came from a classified system.  She said there was. Graham explained that she had interviewed Captain Morton, who had recently returned from R&R.  [NB: Graham at first could not remember Captain Morton’s name but remembered it after a moment.]  According to Graham, Morton had apparently learned about the airstrike video from Bradley Manning. Morton was skeptical about it, but Manning pulled it from SIPRnet and sent a copy to her.

Now the prosecution was finished.  Almanza reminded the prosecution that this was their chance to authenticate documents, at which point the defense objected.  In the words of Kemkes, “The defense doesn’t believe you need to remind the government how to do their job.”

The objection was overruled.

[NB: I did not catch whether this witness was temporarily or permanently excused. If you caught that, please email me at rainey@bradleymanning.org]

Special Agent Calder Robinson

1:25PM The next individual called as a witness by the prosecution was Special Agent Calder, who also appeared telephonically from Germany. Robinson was with the Computer Crimes Investigative Unit (CCIU) in Germany, and in fact was in charge of the Europe Branch office for CID.  He was asked to stand and raise his right hand, then swear to tell the truth. He was asked to put aside any notes he might have and admonished against disclosing classified information without first making the court aware.  He confirmed that he was alone and could speak freely.

The government first established that Robinson was a competent CCIU agent.  He had accumulated over 350 cases since he became a CCIU agent in March 2006, and he had received over 660 hours of training including training in forensic examination.

Upon questioning, Robinson related that he had received a call on 29 May 2010. Based on the information in that call, he traveled to Baghdad to take control of digital evidence, conducted a preliminary forensic examination, and then transported it elsewhere for further forensic examination. He traveled to Camp Liberty in Baghdad, which was considered the best nearby place to collect the data and conduct a preliminary forensic analysis. Robinsons main role was to obtain forensic images of the evidence and conduct the preliminary examination.  He was asked what physical evidence specifically there was, and he had to refer to his notes.

After a moment looking at his notes, Robison related that he had dealt with

• a laptop belonging to Bigalow,
• the personal laptop and hard drive of Bradley Manning,
• several optical discs including one marked secret,
• 2 SIPR machines (1 the assigned work station of Manning and 1 from the supply area),
• 1 SIPR machine from another soldier

NB: I did not hear a mention of a cell phone being included in this list, even though a cell phone was previously alluded to. If you have notes from the hearing and noted a cell phone in this list, please email me at rainey@bradleymanning.org

Robinson explained that he imaged the hard drives and did a preliminary forensic examination. Imaging, he explained, was creating a bit-by-bit copy of the data on a device so that it could not be lost if the device was lost or damaged.  The thoroughness of the imaging was verified because he created a secure hash of the data on both the original machine and the imaged copy, and compared the two hashes. If they were identical, he knew the copy was complete and identical.  He used EnCase to image all of the computers and the 1 optical disc marked “secret.”

At this point, the prosecuting attorney finished up and defense attorney Captain Paul Blouchard stepped up to the speaker phone to address Robinson.

Blouchard reiterated that Robinson had collected hard drives from the digital devices. He then asked if Robinson knew if these computers were used by people other than Bradley Manning.  Robinson hedged slightly, noting that this would be made clear in a full forensic analysis (which he didn’t do).

Upon request from Blouchard, Robinson explained the difference between imaging and forensic analysis.  He said that imaging just meant creating a copy, whereas forensic analysis was a scientific process that could take weeks to months. Robinson was not involved in the full forensic analysis of the devices.

Blouchard asked if his certification was up to date at the time in question, and Robinson confirmed it was.

Blouchard then asked about the preliminary forensic analysis he conducted.  Were the devices catCAC-card accessible?  Robinson was unsure.  Blouchard asked if the devices were password-protected.  Robinson said that all but one of the devices was password protected – the exception being Bradley Manning’s personal computer.

Blouchard then asked about someone named Captain Turetko [NB: I am unsure if I have the spelling of this name correct. If you have a verified spelling, please email rainey@bradleymanning.org]  Blouchard asked if Captain Turetko was involved in one image, and Robinson said he was not. Blouchard asked whether Robinson had instructed Turetko in obtaining network logs, and Robinson said someone from his unit had done so. He added that this was “typical” and that often a tech contact on location would collect network logs while CCIU was remote.  Blouchard asked if Robinson had sent software or instructions to Turetko, and he said not that he recalled.

Blouchard then asked whether Robinson had come across any information in the preliminary forensic examination to indicate that Manning wanted to create an alter ego named Brianna Manning.  Robinson, who had proved himself throughout to be an unflappable and somewhat reticent witness, said that he was familiar with the name but that it did not come up in the analysis.  He was questioned about evidence around Manning’s emotional state, and Robinson mentioned that in the chat logs Manning referred to himself as “fragile.”

Blouchard asked if Robinson had seen evidence that Manning was gay.  Robinson said he had not.

Blouchard asked about GAL (“Global address list”) but Robinson responded in the negative.  Finally Blouchard asked whether there were other user profiles on the computers he worked on.  Robinson said that Manning had a profile.  When pressed about other profiles, he said that he did not recall.

At this point the defense rested.  The prosecution asked Robinson a few clarifying questions. Honing in on the issue of Captain Turetko, Robinson confirmed upon questioning that Turetko obtained network logs for them.  Network logs are, he explained, the digital communications between computers.  He confirmed that Turetko did not image anything.

At this point, Robinson was permanently excused from the pretrial hearing. He was warned against discussing the case with anyone.

Special Agent Mark Mander

1:47 PM  Finally, at 1:47 PM, the government called a witness to appear in person.  Mark Mander, a dark-haired man balding a bit, wore a dark suit and spoke with confidence.

The prosecution began by reviewing Mander’s credentials.  He was from the Army Computer Crimes Investigative Unit.  He had been with CIE since 1994 and had been with the CCIU for 4 years. He had taken over 300 hours of training in computer evidence collection, etc, and had worked on an estimated 20 cases.  He had been involved as a case agent in the Manning proceedings since the evidence was transferred to Camp Liberty in Badghdad.

In describing how he’d ended up on the case, Mander explained that typically the CIU closest to the location of the alleged infringement would take the case. However, since there weren’t federal agents available in Iraq, there was a need to transfer the case to CCIU. Also, the technical subject matter of the case made it more suitable for CCIU.

On June 11, 2011, Mander personally took custody of the evidence.

Mander said that he obtained chats from Mr. Lamo; specifically, an agent from Mander’s office travelled to Adrian Lamo to obtain the Lamo’s computer and hard drive.  Mander noted that it was his understanding that a copy of the chat logs in question were also found on property collected from Bradley Manning.

[NB: my notes here are slightly unclear, so have been omitted]

Mander described how CCIU attempted to go over SIPRnet to obtain a copy of the Granai airstrike video but was ultimately unsuccessful. Thus, they sent agents to Florida to obtain log files, folders, files, and documents in person.  Lt. Col. Schmidtl (sp) provided background information about this video and a password. The file name in question was BE22PAX.zip

Mander described how Lamo had related that an individual he was acquainted with had been in contact with another person who was “bragging” that they were part of the effort to decrypt the Granai airstrike video.  According to Mander, after several days of follow up, it was ascertained that the individual who was “bragging” was Jason Katz, previously employed at Brookhaven National Labs. Per Mander, Jason Katz had worked there from February 2009 to March 2010. He was then terminated from Brookhaven due to issues around misuse of computers.  Brookhaven was able to obtain a forensic image of his work computer as well as his personal computer which had been connected to the work network.
When asked how Brookhaven was able to obtain these images, Mander explained that Katz had waived his rights away by signing an agreement as part of his employment at Brookhaven.  Thus he had consented to having his computer searched and seized. Additionally, Mander said a search warrant was obtained. Through this, they were able to identify a file called B.zip on Katz’s computer [NB: unsure if personal or work computer] and within that folder a document titled BE22PAZ.wmv. Mander explained that this file was encrypted and password protected. When Mander provided the password given to him by Schmidtl, the file opened. It appeared to be the same video as the video of the Granai aistrike.

In the second week of June, 2 CCIU agents went to the State Department and obtained log files of people who accessed the State Department network.  They also obtained “Firewall logs.”

[NB:My notes are a little unclear here and so have been omitted]

Mander also explained that Intel Link was like a search engine that allowed an individual to search documents on SIPRNet.

Mander noted that in the investigation they were able to collect an IP address that corresponded with Bradley Manning’s work computer.

Mander’s unit also collected logs from the CIA.  They were particularly interested in keywords that had been search out.  They also collected  “centaur logs” also known as “F-Flow logs” which are basically connection logs, to show which IP address connected at exactly when and the traffic load.

On 18 June 2010, Mander described contacted Deborah van Alstyne of Potomac, MD – Manning’s aunt. Mander was accompanied by 4 other agents from CCIU an Department of State. In this initial visit, they discussed Manning’s childhood and family life.  Van Alstyne stated that in one of the contacts she had with Manning in Iraq, he had asked about the public reception of the 2007 apache video. After his arrest, Mander said that Manning asked van Alstyne to make a post on his Facebook wall referencing the video.

Mander testified that they searched the home of Deborah, specifically a basement room where Manning’s things were. They were particularly looking for digital media.  They also collected a computer that van Alstyne said belonged to Manning and was kept on and connected to the Internet, though she did not know what it did.

But this was not the end of Mander’s time with Manning’s family.  A few months later, Mander returned. When Manning was apprehended and held in Kuwait, the government collected all of Manning’s items and placed them in a container.  Manders said they made every effort to get a military magistrate to authorize a search or the container, but before it was resolved the container was shipped to van Alstyne’s home (Manning’s home of record).  Mander went back to van Alstyne to see if he could obtain the container.

It turned out that Manning’s aunt had saved the box.  It was intact  and unopened, and she surrendered it to Mander.  Van Alstyne also allowed Mander to conduct a second search of the basement.  This second search was fruitful, in part because the basement had been organized and all of Manning’s effects had been placed in plastic boxes.  On this second search, they were able to find memory cards, a hard drive, optical media discs. The most significant finding was an SD memory card with various bits of information, some of it classified.

As they identified the digital media, they would photograph it in its original location and then place it on the bed. Then van Alstyne verified that the items in question belonged to Manning.

More coming soon! Unfortunately, I got a late start transcribing my notes tonight and didn’t finish everything.  I’ll try to add more before I go into court tomorrow, but if I don’t have time I’ll add to it tomorrow evening when I do my daily update. Still remaining was the defense cross-examination of Mander, the testimony of Special Agent Troy Bettencourt, and the lengthy testimony of Captain Steven Lin, who served with Manning in Iraq.

I’d also like to invite individuals curious about the trial to come down to the courtroom tomorrow; we start at 9 AM.

Resources

EnCase http://www.guidancesoftware.com/forensic.htm

Geanai airstrike https://en.wikipedia.org/wiki/Granai_airstrike

News articles

Bradley Manning Pre-Trial: Live Blog, Day 2

http://dissenter.firedoglake.com/2011/12/17/bradley-manning-pre-trial-live-blog-day-2/

Bradley Manning Defense Reveals Alter Ego Named ‘Breanna Manning’

http://abcnews.go.com/blogs/politics/2011/12/bradley-manning-defense-reveals-alter-ego-named-brianna-manning/

Testimony in Manning’s WikiLeaks case shows breadth of evidence

http://www.latimes.com/news/nationworld/nation/la-na-wiki-manning-20111218,0,918767.story

Private Bradley Manning court martial: investigators found classified information in bedroom basement

http://www.telegraph.co.uk/news/worldnews/wikileaks/8963882/Private-Bradley-Manning-court-martial-investigators-found-classified-information-in-bedroom-basement.html

Private Bradley Manning wanted to call himself ‘Breanna’ on Twitter, US military court is told

http://www.telegraph.co.uk/news/worldnews/northamerica/usa/8963582/Private-Bradley-Manning-wanted-to-call-himself-Breanna-on-Twitter-US-military-court-is-told.html

WikiLeaks lawyers protest at denial of full access to Manning hearing

http://www.guardian.co.uk/world/2011/dec/17/wikileaks-lawyers-protest-manning-hearing?newsfeed=true

Prosecution to Present its Case Against Manning

http://www.salon.com/2011/12/17/prosecution_to_present_its_case_against_manning_3/

Getting into the Courtroom
7:35 AM
Manning’s pretrial hearing (called the Article 32) began on December 16, 2011 at Fort Meade in Maryland.  The weather was chilly and grey, but lightened as the day progressed.  Members of the public and media who wished to attend the trial were processed through the main visitors entrance.  Fort Meade prepared for an enormous turnout — designating a soccer-field sized parking lot for trial attendees and setting up an overflow spectator theater with video feed from the trial that could hold 100 people.

I was one of the first dozen individuals from the public to arrive in the visitor processing area, reaching the courthouse shortly after 7:30 AM.  The courthouse was cordoned off with metal gating with guards at possible entrances. Individuals who wished to go in were told to leave electronic devices in their cars and then sent to a heated trailer to wait on folding chairs for security screening. Everyone who entered the facility went through a metal detector and had purses and bags individually searched. Of those in the trailer seeking entrance, the majority appeared to be Manning supporters coming from far and wide to attend —  Toronto, New York, Boston, San Francisco.

Two of Julian Assange’s lawyers (see last page of notes) were also present, as was a citizen journalist from WLCentral.org.

Twenty members of the public were eventually processed and held in a small outdoor enclosure just outside the court.  After perhaps twenty minutes, we were allowed entrance and settled quietly into the back of the room.

The Article 32
Bradley Manning sat on the left side of the courtroom, his back to the public viewers.  He spoke with quiet animation to the military-appointed attorney by his side, though his words were inaudible to us. At 8:55 AM, Manning’s second military-appointed attorney arrived with David Coombs, his civilian attorney and the leader of his defense team. In the first row of seats behind Manning sat the rest of the legal defense team, including a computer forensics expert and David Coombs’ wife.

There were 9 members of the press present (7 taking notes and 2 sketch artists).  It is possible additional members of the media were present but not clearly distinguishable.

At 9:04 AM, Lt Colonel Paul Almanza, the investigating officer presiding over the Article 32 hearing, entered the room. He moved quickly and carried a large sheaf of documents.

The hearing began with Almanza reading carefully from notes regarding the appropriate conduct of public attendees.  He reiterated that cellular phones and interruptions were forbidden in order
“to protect the dignity and decorum of these proceedings”  and warned that failure to follow these rules would result in an individual being removed from the courtroom.

Almanza spoke softly and carefully, displaying no sign of self-consciousness in these early moments of the proceeding.  His eyes moved from the paper in his hands to Manning and back, not flickering over to the spectators.  He began his interactions with the defense team by establishing that Manning had been appropriately notified of the pretrial hearing on November 28, 2011, and that the defense counsel had offered witnesses and evidence to include in the hearing.

Almanza then asked Manning whether he had the charge sheet in front of him.  Manning, in his first spoken public statement since his arrest 18 months earlier, said “Yes sir, I do.”

Manning was then asked a series of other questions about whether he understood his rights and other administrative matters, to which Manning offered affirmative, respectful responses. His voice was unchanged except when questioned about his legal team and whether he was satisfied with his current legal representation. His answer again was “Yes, sir,” but here his voice changed in tone, adding emphasis and depth.

Almanza reviewed Manning’s rights, including his right to be present in the court throughout the length of the proceedings, the right to cross examine witnesses, the right to provide information as part of the proceedings, the right to legal counsel, the right to call witnesses for the investigating officer to examine, and the right to be silent or to speak in either sworn or unsworn statements. Unsurprisingly, any statements Manning makes in the pretrial can be used against him in the trial.

At this point, Almanza reviewed his own status in the case. A Department of Justice employee, he admitted to seeing some media coverage of the Manning case prior to being detailed to the position.  The government did not have additional questions about this matter, but Coombs had a number.

Coombs rose for every statement he made in the court, and for questioning the investigating officer he actually stepped out from behind the table and approached the investigating officer.  Coombs was particularly interested in learning how the convening authority had become aware of Almanza’s name.  Almanza was unable to answer that question, stating that he’d received a call in August 2010.

Coombs also questioned whether Almanza had taken a course with Coombs in school (Almanza was not sure). He also questioned Almanza’s experience.  Almanza had tried 6 court martials, in which all defendants plead guilty, one of which was a mixed plea. Almanza had prosecuted about 20 cases from 2002 to 2004.

Upon questioning by Coombs, Almanza also acknowledged that the Department of Justice (his employers) has an ongoing investigation around WikiLeaks.  Almanza asserted that he hadn’t spoken to anyone at the Department of Justice about the investigation.

After the initial round of questioning, Coombs became more aggressive in his questioning of the investigating office. Oddly, as the questions became more probing, Almanza became more soft spoken and slightly less organized in his responses, correcting himself several times.  Coombs was particularly keen on the exact dates on which Almanza was detailed to investigating officer of the Manning case, and when he left the DOJ.  Almanza admitted that he was detailed on 12/2 but continued to work in his civilian position at the Department of Justice until 12/12, but stated that he did no more work for the DOJ after that. (NB: this issue comes up later (see below), when Coombs states that the defense received an email from Almanza after 12/12 from Almanza’s civilian Department of Justice email account, thus indicated Almanza was still “wearing the hat” of the DOJ.)

Coombs also questioned what impressions Almanza had formed about the case before stepping in as investigating officer. Almanza admitted he had read articles about the case, but that after he had learned he would be detailed to the case had avoided reading articles whose headlines indicated they were about Manning.  Almanza said that, when he heard about he case, his initial impression was that if the allegations were true, this was a serious matter.  But he insisted that he did not form an opinion based on what he read in the paper because the paper isn’t always accurate and isn’t always the full story.

At the point, Coombs outlined his full argument against Almanza and asked Almanza to recuse himself from the trial.  Speaking eloquently, with broad gestures and stepping back and forth across the court room, Coombs argued that there were four primary reasons that Almanza must recuse himself from the proceedings:

1. Almanza’s position at the Department of Justice, which has an open investigation into the matter of Wikileaks, could bias him in the proceedings. As a career prosecutor at the Department of Justice, a reasonable person could see that Almanza might be biased in the case against Manning. Additionally, the Department of Justice has not ruled out taking over the trial of Bradley Manning altogether.  And furthermore, Almanza had denied Coombs’ request to access information about the Department of Justice’s investigation into Wikileaks.
2. Almanza’s one-sided approval of witnesses. The government submitted a list of 20 people to be called as witnesses.  It was merely a list – no explanation provided for why those individuals were called. Every one of those witnesses was approved by Almanza.  The defense called 48 witnesses, providing a multi-page document explaining why each witness was important to the case.  Of those, 10 were in common with the government and were approved.  Of the remaining 38 witnesses called by the defense, only 2 were approved. NB: statements made by Almanza later in the proceedings seemed to indicate another 2 were later approved, after the original request was made and upon receiving additional legal counsel.
3. Refusal to close the hearing during certain sensitive portions.  Coombs requested that the hearing be closed to the public during a limited portion of the proceeding while discussing information that he felt could damage his client’s ability to receive a fair trial.  Almanza refused.
4. Accepting unsworn statements against objections. Coombs explained that the government had delayed the hearing again and again in order to allow for a review of certain classified information by two witnesses who could speak to how the information was classified and the potential harm it may have caused. Coombs felt it was extraordinarily important that the defense be offered the opportunity to question these witnesses in person during the proceedings.  But Almanza rejected the request, allowing these two witnesses to provide unsworn statements as part of the hearing.  Coombs cited RCM 405, stating that unsworn statements were inadmissible as evidence over objections.

Here Coombs spoke more broadly and passionately about the case, noting that Manning was facing the death sentence over these issues. He urged the court to let him cross examine these witnesses over the appropriate classification of documents, noting that this was of primary importance to the trial because this was the real issue. Coombs asked “Where is the damage? Where is the harm?” Without the opportunity to cross-examine these witnesses, the public and the investigating officer would never know.

Concluding his arguments, Coombs handed a rather thick typed sheaf of papers to the prosecution and Almanza, a motion asking that Almanza be removed.  He sat down again, sipping water.

Almanza asked if the prosecution would like to respond, and the prosecution said it would first need to review the documents.  Around 10 AM, a recess was called.

At 11:32 AM the court reconvened, Bradley Manning again escorted to his seat flanked by attorneys who towered above him. As before, he did not turn to face the audience at any point; the audience was able to catch a glimpse of his face only as he was brought in and out of the court room.

As the court reconvened, the defense asked that the investigating officer seek contact the Chief Trial Advisor for a recommendation on the issue.

The government was then allowed to question the investigating officer. The questions were simple and the answers brief.  Had Almanza reviewed any material about Bradley Manning or WikiLeaks in his position at the Department of Justice?  No.  Had he conversed with anyone at the Department of Justice about Manning or WikiLeaks? No.  Had he followed procedures in agreeing upon the 15 witnesses, considering the difficulty or expense of bringing them to the proceedings and what they would add? Yes. Had he prepared a written finding of his witness list? Yes. Had he consulted with a legal advisor on this matter? Yes. Did he consult with a legal advisor on his interpretation of the rules regarding unsworn witnesses and objections? Yes.

The government created several themes in their questioning and later arguments for keeping Almanza as investigating officer: that procedures were followed, that written findings were created that could be reviewed by judge or appellate court in the future, that legal advise was sought on important matters.

The government asked Almanza whether he felt he could serve as an unbiased judge in this matter, to which Almanza said he could. The government summarized the answers that Amanza had provided and finished by asserting that Almanza could continue to serve as an unbiased and impartial judge.

At this point, Almanza hesitated, then corrected the prosecuting attorney, stating that the standard was not whether he was unbiased but whether a reasonable person, knowing all the facts, could believe that he was not likely to be biased. The prosecution parroted Almanza’s language back to him, stating that the prosecution believed a reasonable person would find Almanza to be free of any potential bias.

David Coombs was quick to argue the issue of perceived bias, noting that Almanza’s interpretation of the standard (“that a reasonable person, knowing all the facts, would believe”) and asserted that no reasonable person would believe that someone working for the Department of Justice would be free of the specter of bias.  In fact, Coombs noted that the defense had received emails from Almanza from the Department of Justice email address even after 12/12.  Almanza countered that the Department of Justice was large and he worked in an area focusing on child exploitation and obscenity, not anything to do with WikiLeaks.

Coombs responded that the standard did not take into account whether the Department of Justice was large, merely whether or not a reasonable person could believe, knowing the facts, that Almanza could be biased.  Coombs then pointed out that the media was already questioning the possibility of impartiality.

He noted that the defense had received emails from Almanza from the Department of Justice email address on 12/12 and after, indicating the Almanza was still wearing the hat of the DOJ.
Almanza also noted that he was not a trial attorney currently, focusing on policy and legislation in his current position.  He restated his concerns about closing the trial for “very limited pieces of information that could taint my client’s ability to get a fair trial.” And Coombs noted again that the case “rises and falls” on whether information is correctly classified.

Coombs was passionate in his defense, perhaps indicating that his courtroom style would be expansive, well-organized arguments that constantly related the trial of Bradley Manning to larger issues of government secrecy. At one point, he turned and spoke directly to the courtroom behind him.  Almanza quickly interrupted, “Mr. Coombs, who are you addressing?”

“The public,” replied Coombs, “Because this is a public trial.”

After this mild reproof, Coombs kept his eyes forward in addressing Almanza.  The court broke for another recess, Coombs ending by urging Almanza to recuse himself and mentioning that he would in fact be asking Defense Appellate Division Army Court of Criminal Appeals (ACCA) to review the case.  He asked Almanza to stay the hearing until Defense Appellate Division ACCA could make a decision.

We were recessed again, and would not have another lengthy speech from Coombs today.

1:38 PM We reconvened briefly.  The rules for behavior in the court were reviewed.  Then Almanza dove right in.

He explained that the Chief Trial Judge wasn’t able to be reached.  They defense team urged Almanza to hold off on deciding whether to recuse himself until speaking with the Chief Trial Judge.

Almanza then denied the request to recuse himself. He stated that he would prepare a written documentation of his decision and send that the Defense Appellate Division ACCA along with a full transcript of the morning’s proceedings.  The prosecution had to call for the full transcript to be prepared (apparently only a summarized transcript had been previously called for), and that the verbatim transcript would then go to the Defense Appellate Division for their consideration.  This transcript wasn’t going to be available to the public, unfortunately, only to Defense Appellate Divisin ACCA and only for the portion of the proceedings up until this point.

We recessed. At 2:17 PM, David Coombs stated there would be at least 10 more minutes of recess.  At 2:47 PM, Coombs again said there would be at least 10 more minutes of recess.

At 3:06 PM, we reconvened very briefly for Almanza to state that we would not recuse himself and summarized his earlier points: that while he was a deputy chief of the Department of Justice, he worked in child exploitation and obscenity and not on matters related to WikiLeaks; that he had spoken to his legal advisor and added witnesses based on a more-informed understanding of the legal rules; that he felt a reasonable person, knowing all the facts, would not believe he was biased. He concluded that a verbatim transcript was being prepared for the writ only.

Another recess.

At 3:25 PM, we reconvened for the last time that day.  Almanza may have been a bit flustered; he left his charge sheet in the judge’s quarters and had to go get it.  Almanza reiterated that his sole function was to serve as an impartial judge in these proceeding. He reminded Manning of his rights, and asked Manning if he would like the charges read aloud.

Manning declined.

As the hearing drew to a close, Almanza brought up the issue of classified documents. He stated that certain classified information might be brought up in the course of the hearing and that a determination would need to be made about whether to close the hearing at that time.  He specifically mentioned, but did not elaborate upon, “three protective orders.”

The proceedings ended.  Alamanza asked for the hearing to begin again on Saturday at 10 AM. Individuals who sat through many long hours of recess seemed reluctant to leave, lingering in the pews. One Manning supporter, a veteran named Nate Goldschlag, shouted as he left the court room “You’re a hero.”  Manning didn’t turn around but the others in the room shot nervous looks to the military police, who did not visibly react. One of the MPs followed the man outside and asked him not to return the next day. See video describing incident: https://www.youtube.com/watch?v=ZYj5Bi_Kg_Q

Other things to note: Two lawyers for Assange were in attendance. At some point during the proceeding, they filed a writ for extraordinary relief or access to the proceedings.  The document is here at the Center for Constitutional Rights  (HT Kevin Gosztola for finding the writ online).

Additional Resources:
David Coombs’ blog
http://www.armycourtmartialdefense.info/
Bradley Manning Support Network blog:
http://www.bradleymanning.org

News Coverage:
Guardian: Bradley Manning hearing: defence lawyer turns fire on military accusers
http://www.guardian.co.uk/world/2011/dec/16/bradley-manning-hearing-defence-lawyer?newsfeed=true

Hearing officer in Manning case is a Justice Department employee in civilian life
http://www.washingtonpost.com/national/hearing-officer-in-manning-case-is-a-justice-department-employee-in-civilian-life/2011/12/16/gIQAMZN1yO_story.html

Manning’s lawyer asks military to stop WikiLeaks hearing
http://www.baltimoresun.com/news/breaking/bs-md-bradley-manning-20111216,0,3698797.story
Investigator in WikiLeaks Case Refuses Recusal
https://www.nytimes.com/2011/12/17/us/bradley-manning-accused-of-aiding-wikileaks-will-appear-in-military-court.html?_r=1

Bradley Manning Trial: Lawyer wants judge removed
http://www.politico.com/news/stories/1211/70560.html

Bradley Manning Pre-Trial Hearing: Live Blog
http://dissenter.firedoglake.com/2011/12/16/bradley-manning-pre-trial-hearing-live-blog/

Photo from CBSNews.com