December 17, 2011: Bradley Manning Support Network sent a representative into the courtroom to take notes for the public on what happened at Bradley Manning’s hearing. No recording devices (like cell phones or audio recorders) were allowed, so all these notes are hand-written and as accurate as written notes and memory allow.  Notes were taken by Rainey Reitman, any omissions or inaccuracies are entirely her fault and not reflective of the Support Network positions. Please send corrections to [email protected]

See day one here.

Getting to the Courtroom

Fort Meade, Maryland Today was just as chilly and grey as the yesterday, about what you would expect for December in Maryland. The hearing was scheduled to being at 10:00 AM and I arrive a bit after 9:15 AM.  Knowing that the majority of the Manning supporters would likely be drawn to the rally outside the gates, I assumed (correctly) that it would not be difficult to get entrance.  I was right; I was able to get into the courtroom and there was room to spare. As yesterday, our bags were searched and we went through metal detectors.

The military police have designated a heated trailer with folding chairs for us to wait in during breaks.  Today, they added a folding table, more chairs, and two water coolers with cups.

The Article 32

10:34 AM Bradley Manning entered with David Coombs and his two military-assigned attorneys.  When the investigating officer, Lt. Col. Paul Almanza, arrived, he appeared to be chewing something (maybe a lozenge?).  The IO reviewed the court room rules again, advising the spectators not the interrupt or have cellular phones or they could be subject to removal.

Almanza then began by asking Manning’s two military-appointed JAGs, Blouchard and Kemkes, whether they were both certified by military law and authorized to represent Bradley Manning.  Blouchard and Kemkes confirmed they were.

Special Agent Toni Graham

Things moved much more quickly on day two of the pretrial hearing.  The government called their first witness, Special Agent Toni Graham. S.A. Graham was in Hawaii, and unfortunately the connection was not ideal.  The government spent time fiddling with the podium equipment in an attempt to call her, then pulled in a young military support technician with ear studs to help fix the issue.  When at last Graham was on the phone, the connection was static-filled and her voice was nearly incomprehensible.  She was asked to stand and raise her right hand, then swear to tell the truth, and then warned that if she needed to disclose sensitive information that she should note that and wait before making the disclosure.

Her confirmation was hard to understand at best.  Media representatives and public spectators (myself among them) exchanged incredulous looks at the technical difficulties.  Almanza interrupted, stating that he was having difficulty understand her response to a question.  He asked whether she was on a cell phone or a land line, and Graham admitted she was on a cell phone but offered to move to her office so she could talk from a landline.  The defense urged the court to ensure that Graham was in a place where she would be able to speak freely.

A recess was called, mere minutes after the hearing began, so Graham could make the thirty minute trip to her office line.

11:30 AM  Everyone returned to their places, and Almanza quizzed the government about whether the technical difficulties were addressed. The lead attorney for the government, perhaps a bit chagrined, stated that the issue was resolved and it had been a problem with the courtroom connection.  However, they’d switched to a different phone and had already called the first 2 witnesses to check the audio quality.

Toni Graham was again introduced and sworn in.  Her position in the 102^nd Military Police detachment was reviewed, and she stated she was in a place she could speak privately and with freedom. She admitted to having the AIR she had produced (ref number 00000184-190) on hand, but agreed upon defense request to set it aside and notify the court if she needed to refer to it.

Graham was a CID (criminal investigations) agent.  In the Manning case, her primary duties were to protect, collect, and preserve digital device evidence.  The prosecution asked her about her experience, and she said she worked on perhaps 100 cases per year. She was serving on a battalion in Baghdad on 27 May 2010 when she received instructions from her headquarters based on information from a confidential informant.  She then received a search warrant from a military magistrate and developed a team, including Thomas Smith, a counter intelligence agent, and another individual.

Graham was charged with collecting the personal computer and additional digital devices related to the Bradley Manning investigation. She also canvassed acquaintances and collected his personal, SCIF computers, and 2 SIPR computers.

Graham also searched the Containerized Housing Unit (CHU) where Manning resided.  She took a personal computer, hard drive, cell phone, 10 DVDs, and 1 CD marked with the word “secret: in a U.S. postal shipping package. She testified that there were perhaps 100 yards between the SCIF and CHU.  She also took digital devices from the supply section, since she learned Manning had recently been reassigned to supplies.  From the supply area she took another SIPR computer and one other computer. She also obtained a computer belonging to a Captain Bigalow, as allegedly Manning had used this computer. She also found out that Manning had used a secret scanner on two occasions, and so she collected that computer.

Graham testified that she’d received authorization to seize and search the devices via her commander, as well as with consent from Bigalow, and also through formal search authorization granted to her.

On June 11, 2010, the investigation was transferred to the Computer Crimes Investigating Unit (CCIU). That is because CCIU has additional technical expertise, and all of the evidence in this matter was computer-related.  Graham described the evidence being moved to CCIU through a “controlled transfer” – physical evidence hand delivered and additional evidence sent via registered mail.   Evidence was thus hand delivered to Kuwait, then to Virginia.

At this point the prosecution rested and defense attorney Major Matthew Kemkes stepped forward.  Kemkes has a respectful, somewhat solemn, strikingly earnest style in his courtroom delivery.  He came across as thoughtful, and seemed somehow more restrained than Coombs.

Kemkes began by asking Graham if she was the first lead agent in the investigation, which she confirmed.   He then noted that it seemed she was a truly central figure in the investigation, since she was serving now as the government first witness.  He asked whether she had been asked to attend the proceedings in person, and why she had not done so.  She responded that she was in Hawaii and needed to seek approval in order to travel for the proceedings.

At this point Almanza halted the line of questioning, his voice hoarse, and asked about the purpose of this questioning.  Kemkes replied with candor, reiterating earlier defense arguments about the need to have important witnesses on site for the proceedings for in-person cross-examination.  Almanza was unconvinced, referring to his early finding about this issue.

Kemkes proceeded quickly.  After a quick review of her credentials and history, Kemkes confirmed with Graham that she had received search authorization from a military magistrate before searching the CHU.  He asked whether she had signed the 5/29/10 affidavit which stated that Bradley Manning had sent classified documents to outside sources and would share more.  Graham responded that she had indeed signed the affidavit, and in fact had reviewed it recently (within the last 2 weeks).  She confirmed that the affidavit did state the Manning had released TS-SCI information and cables onto the Internet.  Upon questioning, she admitted that much of her affidavit was based on information from commanders at Ft. Belvoir who had received intelligence from a confidential informant. The affidavit also specifically mentioned an article in the Stars and Stripes military publication called “A Wiki for a World of Secrets.”

Kemkes was methodical in questioning the contents of the affidavit Graham provided.  But he was quickly able to hone in on her primary reason for filing the affidavit: because she knew that the Apache helicopter video showing Reuters journalists was confidential information and that millions (5 million? 5 billion? she asked) of “unauthorized individuals” had viewed this document. She did mention that “There were other reasons that I did not provide in the affidavit,” but admitted that the primary ones were those listed in the affidavit itself, especially the release of the Apache helicopter video.

Kemkes asked whether Graham stood by the affidavit she signed, and she confirmed, stating that TS/SCI had been leaked onto the Internet.

Kemkes then asked how she would feel if she found out that the video in question was unclassified, if in fact the 8 million people who saw it had seen an unclassified video.  Graham struggled to answer this question, and was skeptical of Kemkes’ assertion that the video was unclassified.  Kemkes asked how Graham has heard that the video was classified when she filed her affidavit, and Graham said the information had come by way of the confidential informant

Kemkes then picked apart another statement Graham made in her affidavit. He noted that her affidavit stated Manning had been penetrating .mil and .gov accounts for over a year.  Kemkes pointed out that the affidavit was produced in May 2010, and that Manning had only been deployed since November 2009.  How, then, could Graham be sure that he was penetrating systems for over a year?

“I can’t say for sure he was going it for over a year,” Graham admitted.  This information was also something she had gathered by way of the confidential informant’s report.

Kemkes asked Graham about a box containing DVDs she had collected on 7/12/09, including one disc labeled “secret.”  He proceeded to ask about whether she had searched and inventoried other items beyond digital media? She said she had not.  He asked whether she knew that Manning might have gender identity disorder, and she said in fact she had.  Kemkes asked whether Graham has discovered any evidence about this issue when collecting evidence for the case. She could not recall. He asked if she had found anything like that, including medical pamphlets or articles printed from the Internet. She could not recall.  Kemkes asked about a specific medical pamphlet from Canada that reviewed options for dealing with gender identity disorder, including changing one’s dress, hormone therapy, facial surgery, and gender reassignment. Graham again could not recall.

At this point the prosecution objected, asking for the relevance of the questioning. The objection was overruled.

Upon further questioning, Graham admitted that she had seen “several things about homosexuality” when collecting evidence from Manning’s CHU.  Kemkes asked what Graham had done with these things.  Graham replied “I left it in his room.”  Kemkes now asked a few incredulous questions, asking how often she had encountered similar situations where soldiers had copies of Flight Into Hypermasculinity. Almanza admonished Kemkes, urging him to “try to focus on the thoroughness of the investigation.”

Asked again what she did with evidence about Manning’s sexuality, Graham said she “set it to the side.”  She then said plainly that “we already knew before we arrived” that Manning was a homosexual.  She added, awkwardly, “I don’t know if the proper term is transvestite.” [NB: based on the context, I don’t believe Graham was confused about the difference between a transvestite and a homosexual. Rather, I believe she was certain Manning was gay but uncertain whether other factors might also make him a transvestite. She might also have been searching for the word “transgender.”]

Graham explained that in the course of her evidence collection she had conducted 5 interviews and canvassed other people who knew Manning. All interviews were conducted face to face. Kemkes asked if she would agree that Manning didn’t have a lot of friends in the unit.  Graham agreed.  She was asked about his relative popularity, but the prosecution objected.

Kemkes defended his questioning to the IO, stating that these all helped better understand that situation and stating that “what is going on in my client’s mind is very important.”

Kemkes asked whether there was a belief noted in the interviews that Manning was gay.  Graham said no, that it was not brought up.  There was no mention in these interviews of behavioral issues or mental disturbance.

Kemkes noted that Graham’s affidavit was that major piece of documentation affecting the pre-trial confinement hearing of Bradley Manning.  He asked Graham if she was now comfortable with that affidavit being the basis of his pretrial confinement. She statement merely “That was the information I had at the time.”

Here Kemkes stepped away from the speaker phone for the telephone next to the IO and briefly conferred with the defense team. At last he sat down, and the government stepped up for a brief round of questioning before the group broke for recess.

The government stepped up for a quick line of questioning, following an argument pattern the government seems keen to identify: that procedures were appropriately followed. The government asked whether, at the time Graham signed her affidavit, she as aware that TS/SCI information had been compromised. She said she was. [NB: a section of this questioning is unclear from my notes. Apologies.] She briefly discussed the confidential informant who provided them with information, noting that he was in direct contact with the FBI.

The government asked Graham whether there was evidence to suggest that the Apache airstrike video came from a classified system.  She said there was. Graham explained that she had interviewed Captain Morton, who had recently returned from R&R.  [NB: Graham at first could not remember Captain Morton’s name but remembered it after a moment.]  According to Graham, Morton had apparently learned about the airstrike video from Bradley Manning. Morton was skeptical about it, but Manning pulled it from SIPRnet and sent a copy to her.

Now the prosecution was finished.  Almanza reminded the prosecution that this was their chance to authenticate documents, at which point the defense objected.  In the words of Kemkes, “The defense doesn’t believe you need to remind the government how to do their job.”

The objection was overruled.

[NB: I did not catch whether this witness was temporarily or permanently excused. If you caught that, please email me at [email protected]]

Special Agent Calder Robinson

1:25PM The next individual called as a witness by the prosecution was Special Agent Calder, who also appeared telephonically from Germany. Robinson was with the Computer Crimes Investigative Unit (CCIU) in Germany, and in fact was in charge of the Europe Branch office for CID.  He was asked to stand and raise his right hand, then swear to tell the truth. He was asked to put aside any notes he might have and admonished against disclosing classified information without first making the court aware.  He confirmed that he was alone and could speak freely.

The government first established that Robinson was a competent CCIU agent.  He had accumulated over 350 cases since he became a CCIU agent in March 2006, and he had received over 660 hours of training including training in forensic examination.

Upon questioning, Robinson related that he had received a call on 29 May 2010. Based on the information in that call, he traveled to Baghdad to take control of digital evidence, conducted a preliminary forensic examination, and then transported it elsewhere for further forensic examination. He traveled to Camp Liberty in Baghdad, which was considered the best nearby place to collect the data and conduct a preliminary forensic analysis. Robinsons main role was to obtain forensic images of the evidence and conduct the preliminary examination.  He was asked what physical evidence specifically there was, and he had to refer to his notes.

After a moment looking at his notes, Robison related that he had dealt with

• a laptop belonging to Bigalow,
• the personal laptop and hard drive of Bradley Manning,
• several optical discs including one marked secret,
• 2 SIPR machines (1 the assigned work station of Manning and 1 from the supply area),
• 1 SIPR machine from another soldier

NB: I did not hear a mention of a cell phone being included in this list, even though a cell phone was previously alluded to. If you have notes from the hearing and noted a cell phone in this list, please email me at [email protected]

Robinson explained that he imaged the hard drives and did a preliminary forensic examination. Imaging, he explained, was creating a bit-by-bit copy of the data on a device so that it could not be lost if the device was lost or damaged.  The thoroughness of the imaging was verified because he created a secure hash of the data on both the original machine and the imaged copy, and compared the two hashes. If they were identical, he knew the copy was complete and identical.  He used EnCase to image all of the computers and the 1 optical disc marked “secret.”

At this point, the prosecuting attorney finished up and defense attorney Captain Paul Blouchard stepped up to the speaker phone to address Robinson.

Blouchard reiterated that Robinson had collected hard drives from the digital devices. He then asked if Robinson knew if these computers were used by people other than Bradley Manning.  Robinson hedged slightly, noting that this would be made clear in a full forensic analysis (which he didn’t do).

Upon request from Blouchard, Robinson explained the difference between imaging and forensic analysis.  He said that imaging just meant creating a copy, whereas forensic analysis was a scientific process that could take weeks to months. Robinson was not involved in the full forensic analysis of the devices.

Blouchard asked if his certification was up to date at the time in question, and Robinson confirmed it was.

Blouchard then asked about the preliminary forensic analysis he conducted.  Were the devices catCAC-card accessible?  Robinson was unsure.  Blouchard asked if the devices were password-protected.  Robinson said that all but one of the devices was password protected – the exception being Bradley Manning’s personal computer.

Blouchard then asked about someone named Captain Turetko [NB: I am unsure if I have the spelling of this name correct. If you have a verified spelling, please email [email protected]]  Blouchard asked if Captain Turetko was involved in one image, and Robinson said he was not. Blouchard asked whether Robinson had instructed Turetko in obtaining network logs, and Robinson said someone from his unit had done so. He added that this was “typical” and that often a tech contact on location would collect network logs while CCIU was remote.  Blouchard asked if Robinson had sent software or instructions to Turetko, and he said not that he recalled.

Blouchard then asked whether Robinson had come across any information in the preliminary forensic examination to indicate that Manning wanted to create an alter ego named Brianna Manning.  Robinson, who had proved himself throughout to be an unflappable and somewhat reticent witness, said that he was familiar with the name but that it did not come up in the analysis.  He was questioned about evidence around Manning’s emotional state, and Robinson mentioned that in the chat logs Manning referred to himself as “fragile.”

Blouchard asked if Robinson had seen evidence that Manning was gay.  Robinson said he had not.

Blouchard asked about GAL (“Global address list”) but Robinson responded in the negative.  Finally Blouchard asked whether there were other user profiles on the computers he worked on.  Robinson said that Manning had a profile.  When pressed about other profiles, he said that he did not recall.

At this point the defense rested.  The prosecution asked Robinson a few clarifying questions. Honing in on the issue of Captain Turetko, Robinson confirmed upon questioning that Turetko obtained network logs for them.  Network logs are, he explained, the digital communications between computers.  He confirmed that Turetko did not image anything.

At this point, Robinson was permanently excused from the pretrial hearing. He was warned against discussing the case with anyone.

Special Agent Mark Mander

1:47 PM  Finally, at 1:47 PM, the government called a witness to appear in person.  Mark Mander, a dark-haired man balding a bit, wore a dark suit and spoke with confidence.

The prosecution began by reviewing Mander’s credentials.  He was from the Army Computer Crimes Investigative Unit.  He had been with CIE since 1994 and had been with the CCIU for 4 years. He had taken over 300 hours of training in computer evidence collection, etc, and had worked on an estimated 20 cases.  He had been involved as a case agent in the Manning proceedings since the evidence was transferred to Camp Liberty in Badghdad.

In describing how he’d ended up on the case, Mander explained that typically the CIU closest to the location of the alleged infringement would take the case. However, since there weren’t federal agents available in Iraq, there was a need to transfer the case to CCIU. Also, the technical subject matter of the case made it more suitable for CCIU.

On June 11, 2011, Mander personally took custody of the evidence.

Mander said that he obtained chats from Mr. Lamo; specifically, an agent from Mander’s office travelled to Adrian Lamo to obtain the Lamo’s computer and hard drive.  Mander noted that it was his understanding that a copy of the chat logs in question were also found on property collected from Bradley Manning.

[NB: my notes here are slightly unclear, so have been omitted]

Mander described how CCIU attempted to go over SIPRnet to obtain a copy of the Granai airstrike video but was ultimately unsuccessful. Thus, they sent agents to Florida to obtain log files, folders, files, and documents in person.  Lt. Col. Schmidtl (sp) provided background information about this video and a password. The file name in question was BE22PAX.zip

Mander described how Lamo had related that an individual he was acquainted with had been in contact with another person who was “bragging” that they were part of the effort to decrypt the Granai airstrike video.  According to Mander, after several days of follow up, it was ascertained that the individual who was “bragging” was Jason Katz, previously employed at Brookhaven National Labs. Per Mander, Jason Katz had worked there from February 2009 to March 2010. He was then terminated from Brookhaven due to issues around misuse of computers.  Brookhaven was able to obtain a forensic image of his work computer as well as his personal computer which had been connected to the work network.
When asked how Brookhaven was able to obtain these images, Mander explained that Katz had waived his rights away by signing an agreement as part of his employment at Brookhaven.  Thus he had consented to having his computer searched and seized. Additionally, Mander said a search warrant was obtained. Through this, they were able to identify a file called B.zip on Katz’s computer [NB: unsure if personal or work computer] and within that folder a document titled BE22PAZ.wmv. Mander explained that this file was encrypted and password protected. When Mander provided the password given to him by Schmidtl, the file opened. It appeared to be the same video as the video of the Granai aistrike.

In the second week of June, 2 CCIU agents went to the State Department and obtained log files of people who accessed the State Department network.  They also obtained “Firewall logs.”

[NB:My notes are a little unclear here and so have been omitted]

Mander also explained that Intel Link was like a search engine that allowed an individual to search documents on SIPRNet.

Mander noted that in the investigation they were able to collect an IP address that corresponded with Bradley Manning’s work computer.

Mander’s unit also collected logs from the CIA.  They were particularly interested in keywords that had been search out.  They also collected  “centaur logs” also known as “F-Flow logs” which are basically connection logs, to show which IP address connected at exactly when and the traffic load.

On 18 June 2010, Mander described contacted Deborah van Alstyne of Potomac, MD – Manning’s aunt. Mander was accompanied by 4 other agents from CCIU an Department of State. In this initial visit, they discussed Manning’s childhood and family life.  Van Alstyne stated that in one of the contacts she had with Manning in Iraq, he had asked about the public reception of the 2007 apache video. After his arrest, Mander said that Manning asked van Alstyne to make a post on his Facebook wall referencing the video.

Mander testified that they searched the home of Deborah, specifically a basement room where Manning’s things were. They were particularly looking for digital media.  They also collected a computer that van Alstyne said belonged to Manning and was kept on and connected to the Internet, though she did not know what it did.

But this was not the end of Mander’s time with Manning’s family.  A few months later, Mander returned. When Manning was apprehended and held in Kuwait, the government collected all of Manning’s items and placed them in a container.  Manders said they made every effort to get a military magistrate to authorize a search or the container, but before it was resolved the container was shipped to van Alstyne’s home (Manning’s home of record).  Mander went back to van Alstyne to see if he could obtain the container.

It turned out that Manning’s aunt had saved the box.  It was intact  and unopened, and she surrendered it to Mander.  Van Alstyne also allowed Mander to conduct a second search of the basement.  This second search was fruitful, in part because the basement had been organized and all of Manning’s effects had been placed in plastic boxes.  On this second search, they were able to find memory cards, a hard drive, optical media discs. The most significant finding was an SD memory card with various bits of information, some of it classified.

As they identified the digital media, they would photograph it in its original location and then place it on the bed. Then van Alstyne verified that the items in question belonged to Manning.

More coming soon! Unfortunately, I got a late start transcribing my notes tonight and didn’t finish everything.  I’ll try to add more before I go into court tomorrow, but if I don’t have time I’ll add to it tomorrow evening when I do my daily update. Still remaining was the defense cross-examination of Mander, the testimony of Special Agent Troy Bettencourt, and the lengthy testimony of Captain Steven Lin, who served with Manning in Iraq.

I’d also like to invite individuals curious about the trial to come down to the courtroom tomorrow; we start at 9 AM.

Resources

EnCase http://www.guidancesoftware.com/forensic.htm

Geanai airstrike https://en.wikipedia.org/wiki/Granai_airstrike

News articles

Bradley Manning Pre-Trial: Live Blog, Day 2

http://dissenter.firedoglake.com/2011/12/17/bradley-manning-pre-trial-live-blog-day-2/

Bradley Manning Defense Reveals Alter Ego Named ‘Breanna Manning’

http://abcnews.go.com/blogs/politics/2011/12/bradley-manning-defense-reveals-alter-ego-named-brianna-manning/

Testimony in Manning’s WikiLeaks case shows breadth of evidence

http://www.latimes.com/news/nationworld/nation/la-na-wiki-manning-20111218,0,918767.story

Private Bradley Manning court martial: investigators found classified information in bedroom basement

http://www.telegraph.co.uk/news/worldnews/wikileaks/8963882/Private-Bradley-Manning-court-martial-investigators-found-classified-information-in-bedroom-basement.html

Private Bradley Manning wanted to call himself ‘Breanna’ on Twitter, US military court is told

http://www.telegraph.co.uk/news/worldnews/northamerica/usa/8963582/Private-Bradley-Manning-wanted-to-call-himself-Breanna-on-Twitter-US-military-court-is-told.html

WikiLeaks lawyers protest at denial of full access to Manning hearing

http://www.guardian.co.uk/world/2011/dec/17/wikileaks-lawyers-protest-manning-hearing?newsfeed=true

Prosecution to Present its Case Against Manning

http://www.salon.com/2011/12/17/prosecution_to_present_its_case_against_manning_3/