Guantanamo detainee briefs and the global address list: trial report, day 7
By Nathan Fuller, Bradley Manning Support Network. June 17, 2013.
The third week of Bradley Manning’s court martial began with testimony about Guantanamo Bay detainee assessment briefs (DABs) that WikiLeaks released as the GITMO Files, and the Global Address List (GAL) that the government claims Bradley stole. The GAL is a collection of military email addresses. In February, Bradley pled not guilty to illegally obtaining that list.
This morning, after a long recess during which the parties continued to confer privately, we heard only stipulations of agreed-upon expected testimony.
Guantanamo detainee briefs
Prosecutors read testimony from Jeffrey Motes, a senior counterterror analyst at Guantanamo Bay, who led the team that created the DABs and spoke to why they were classified. The DABs include detainees’ background information, details of their capture, their affiliation with terrorist groups, indicators of their threat level, and Motes’ team’s analysis of that threat level. While Motes says that the detainees and their affiliates likely already knew all of that information, they didn’t know the U.S.’s assessment and the extent of its knowledge.
The five briefs that Motes reviewed for the investigation into Bradley’s release, he said, included or mentioned Techniques, Tactics, and Procedures (TTPs) of enemy movements, enemy recruitment activities, and engagements with enemy forces – the disclosure of which, he said, could alter enemy practices.
The government also read stipulation of expected testimony for Rear Admiral David Woods, an Original Classification Authority who reviewed the Guantanamo DABs and, following Executive Order guidelines, determined they were properly classified at the Secret level. Woods also said that when reviewing the DABs, he did not consider “open-source material” in the public realm.
We also heard stipulations for Navy Vice Admiral Robert Harward, who reviewed CENTCOM documents, and former Army NCO Louis Travieso, a Defense Intelligence Agency intelligence analyst at CENTCOM. Travieso conducted a line-by-line review of the charged documents in the Iraq and Afghan war logs, as well as documents from the Farah incident and investigation.
All of this testimony likely goes to whether Bradley had reason to believe he was releasing “closely held” information “relating to the national defense,” a threshold not met by mere classification level alone.
Global Address List background
The government says Bradley Manning did “steal, purloin, or knowingly convert” the GAL in violation of 18 U.S.C. 641, a ten-year offense. It contends Bradley had a list of some 74,000 military email addresses on his unclassified NIPRNet computer, which he used in the supply annex.
The government has pointed to WikiLeaks’ tweet requesting ‘.mil email addresses’ as evidence that Bradley was acting under the Julian Assange’s direction. Forensic expert Mark Johnson testified last week that on the unallocated (deleted) portion of one of Bradley’s computers, he found evidence of a ‘tasker’ in which someone allegedly requested Bradley “exfiltrate” or extract the global address list, and evidence that the list was on his computer and had been deleted, but no specific request for it to be sent to WikiLeaks. He found no evidence on that computer that the list was extracted or transferred.
Afternoon update – GAL Testimony
CWO4 Nixon testified about access to the Global Address List, which he described as a function of the ‘active directory.’ He distinguished between ‘access’ and ‘visibility’ – those with user accounts could search for a name within the Iraq GAL and have access to it, but the list of addresses and names wasn’t visible in full (though it was to those with administrative accounts). Someone logged on to a user account couldn’t simply download the list of addresses for their brigade, s/he would have to manually copy and paste each one individually. He didn’t confirm the government’s earlier number of 74,000 addresses – when he was handed a CD and asked how many addresses were on it, he said about 24,000.
The government read testimony for Special Agent Alfred Williamson, from the Army Criminal Investigations Unit, who forensically examined the supply annex computer that Bradley used but which belonged to Staff Sergeant Peter Bigelow, supply room supervisor. Williamson said user account ‘Bradley.Manning’ searched Google News for ‘WikiLeaks’ and ‘nonjudicial punishment,’ and he found encrypted emails between Bradley and Adrian Lamo. He also said it appeared that Bradley, or someone on his account, was using the ‘Peter.Bigelow’ account, as he viewed Bradley’s gmail account and other personal documents. Williamson found five files related to the GAL, and several ‘blah-named files’ (Bradley said he compressed two documents into a file named Blah.zip), created and deleted on May 13, 2010.
Prosecutors read testimony from Peter Bigelow, confirming that Bigelow allowed Bradley to use his personal computer after he noticed Bradley was checking his Gmail on a NIPRNet (non-Secret, military) computer, and that he didn’t conduct searches for WikiLeaks and didn’t create the ‘Blah’ folder.
GAL value and access
Chief Warrant Officer 4 Armond Rouillard testified about the GAL’s value, which he divided into monetary and cyber-threat categories, the latter of which the Army focuses on. With the GAL email addresses, an adversary could target ‘spearphishing’ campaigns against specific users and gain access to their military computers.
But the defense objected to the government offering Rouillard as an expert on GAL’s monetary value, because Specification 16 of Charge 2 specifically alleges Bradley stole or converted the list “of a value of more than $1,000, in violation of 18 U.S. Code Section 641.”
When pressed, the government withdrew its presentation of Rouillard as an expert on the GAL’s value, and he was instead accepted only as an expert on the GAL itself and cyber-security more generally.
The defense established on cross-examination that there was no directive prohibiting the downloading of the address list.
More stipulations and recesses
The parties are continuing to agree to more and more stipulations of expected testimony, currently working on 17 more behind the scenes. This brings another long recess. Tomorrow at 9:30 AM, they’ll present oral arguments on the admissibility of certain prosecution exhibits. After that, the court will be in recess until Tuesday, when we’ll hear an update on the stipulations, and on Wednesday the government’s case will resume. The parties also agreed that the government will not call any sentencing witnesses earlier than July 8.
PFC Bradley Manning (sketch by Debra Van Poolen – click for source)
This morning, after a long recess during which the parties continued to confer privately, we heard only stipulations of agreed-upon expected testimony.
Guantanamo detainee briefs
Prosecutors read testimony from Jeffrey Motes, a senior counterterror analyst at Guantanamo Bay, who led the team that created the DABs and spoke to why they were classified. The DABs include detainees’ background information, details of their capture, their affiliation with terrorist groups, indicators of their threat level, and Motes’ team’s analysis of that threat level. While Motes says that the detainees and their affiliates likely already knew all of that information, they didn’t know the U.S.’s assessment and the extent of its knowledge.
The five briefs that Motes reviewed for the investigation into Bradley’s release, he said, included or mentioned Techniques, Tactics, and Procedures (TTPs) of enemy movements, enemy recruitment activities, and engagements with enemy forces – the disclosure of which, he said, could alter enemy practices.
The government also read stipulation of expected testimony for Rear Admiral David Woods, an Original Classification Authority who reviewed the Guantanamo DABs and, following Executive Order guidelines, determined they were properly classified at the Secret level. Woods also said that when reviewing the DABs, he did not consider “open-source material” in the public realm.
We also heard stipulations for Navy Vice Admiral Robert Harward, who reviewed CENTCOM documents, and former Army NCO Louis Travieso, a Defense Intelligence Agency intelligence analyst at CENTCOM. Travieso conducted a line-by-line review of the charged documents in the Iraq and Afghan war logs, as well as documents from the Farah incident and investigation.
All of this testimony likely goes to whether Bradley had reason to believe he was releasing “closely held” information “relating to the national defense,” a threshold not met by mere classification level alone.
Global Address List background
The government says Bradley Manning did “steal, purloin, or knowingly convert” the GAL in violation of 18 U.S.C. 641, a ten-year offense. It contends Bradley had a list of some 74,000 military email addresses on his unclassified NIPRNet computer, which he used in the supply annex.
The government has pointed to WikiLeaks’ tweet requesting ‘.mil email addresses’ as evidence that Bradley was acting under the Julian Assange’s direction. Forensic expert Mark Johnson testified last week that on the unallocated (deleted) portion of one of Bradley’s computers, he found evidence of a ‘tasker’ in which someone allegedly requested Bradley “exfiltrate” or extract the global address list, and evidence that the list was on his computer and had been deleted, but no specific request for it to be sent to WikiLeaks. He found no evidence on that computer that the list was extracted or transferred.
Afternoon update – GAL Testimony
CWO4 Nixon testified about access to the Global Address List, which he described as a function of the ‘active directory.’ He distinguished between ‘access’ and ‘visibility’ – those with user accounts could search for a name within the Iraq GAL and have access to it, but the list of addresses and names wasn’t visible in full (though it was to those with administrative accounts). Someone logged on to a user account couldn’t simply download the list of addresses for their brigade, s/he would have to manually copy and paste each one individually. He didn’t confirm the government’s earlier number of 74,000 addresses – when he was handed a CD and asked how many addresses were on it, he said about 24,000.
The government read testimony for Special Agent Alfred Williamson, from the Army Criminal Investigations Unit, who forensically examined the supply annex computer that Bradley used but which belonged to Staff Sergeant Peter Bigelow, supply room supervisor. Williamson said user account ‘Bradley.Manning’ searched Google News for ‘WikiLeaks’ and ‘nonjudicial punishment,’ and he found encrypted emails between Bradley and Adrian Lamo. He also said it appeared that Bradley, or someone on his account, was using the ‘Peter.Bigelow’ account, as he viewed Bradley’s gmail account and other personal documents. Williamson found five files related to the GAL, and several ‘blah-named files’ (Bradley said he compressed two documents into a file named Blah.zip), created and deleted on May 13, 2010.
Prosecutors read testimony from Peter Bigelow, confirming that Bigelow allowed Bradley to use his personal computer after he noticed Bradley was checking his Gmail on a NIPRNet (non-Secret, military) computer, and that he didn’t conduct searches for WikiLeaks and didn’t create the ‘Blah’ folder.
GAL value and access
Chief Warrant Officer 4 Armond Rouillard testified about the GAL’s value, which he divided into monetary and cyber-threat categories, the latter of which the Army focuses on. With the GAL email addresses, an adversary could target ‘spearphishing’ campaigns against specific users and gain access to their military computers.
But the defense objected to the government offering Rouillard as an expert on GAL’s monetary value, because Specification 16 of Charge 2 specifically alleges Bradley stole or converted the list “of a value of more than $1,000, in violation of 18 U.S. Code Section 641.”
When pressed, the government withdrew its presentation of Rouillard as an expert on the GAL’s value, and he was instead accepted only as an expert on the GAL itself and cyber-security more generally.
The defense established on cross-examination that there was no directive prohibiting the downloading of the address list.
More stipulations and recesses
The parties are continuing to agree to more and more stipulations of expected testimony, currently working on 17 more behind the scenes. This brings another long recess. Tomorrow at 9:30 AM, they’ll present oral arguments on the admissibility of certain prosecution exhibits. After that, the court will be in recess until Tuesday, when we’ll hear an update on the stipulations, and on Wednesday the government’s case will resume. The parties also agreed that the government will not call any sentencing witnesses earlier than July 8.
No comments:
Post a Comment