Title: Volume FOIA 037

Release Date: 2014-03-20

Text: 11452

Volume 37 of 111
SJAR ROT
FOIA Version

VERBAT IM 1

RECORD OF TRIAL2

(and accompanying papers)

of
(Name: Last, First, Middie initiai) (Sociai Security Number) (Rank)
Headquarters and
Headquarters Company,
United States Army Garrison U-S- Army FCDIJC Ml/er: VA 22211
(Unit/Command Name) (Branch of Service) (Station or Snip)
By
GENERAL COURT-MARTIAL
Convened by Commander

(Titie of Con vening Authority)

UNITED STATES ARMY MILITARY DISTRICT OF WASHINGTON
(Unit/Command of Con vening Authority)

Tried at

Fort. Meade, MD on see below

(Piace or Piaces of Triai) (Date or Dates of Triai-9

Date or Dates of Trial:

23 February 2012, 15-16 March 2012, 24-26 April 2012, 6-8 June 2012, 25 June 2012,

16-19 July 2012, 28-30 August 2012, 2 October 2012, 12 October 2012, 17-18 October 2012,
7-8 November 2012, 27 November - 2 December 2012, 5-7 December 2012, 10-11 December 2012,
8-9 January 2013, 16 January 2013, 26 February - 1 March 2013, 8 March 2013,

10 April 2013, 7-8 May 2013, 21 May 2013, 3-5 June 2013, 10-12 June 2013, 17-18 June 2013,
25-28 June 2013, 1-2 July 2013, 8-10 July 2013, 15 July 2013, 18-19 July 2013,

25-26 July 2013, 28 July - 2 August 2013, 5-9 August 2013, 12-14 August 2013,

16 August 2013, and 19-21 August 2013.

1 insert ?verbatirri or ?surrimarizeo? as appropriate. This form be used by the Army and Navy for verbatim records of triai

2 See inside back co ver for instructions as to preparation and arrangement.

DD FORM 490, MAY 2000 PREWOUS OBSOLETE Front Cover

11453

1

A.

I still continued to do the target analyst job.

2

Q.

Did you still have Specialist Showman working for you?

3

A.

She was still in the SCIF and we were working together to

4
5
6

continue the targeting mission that we had.
Q.

During your entire time did you ever get information you

needed from the S-2 section?

7

A.

Yes.

8

Q.

And when was that?

9

A.

Over the course of the 4 months that I worked in the SCIF

10

itself we still received reporting.

11

getting any reporting.

12

that was relevant to what we were doing.

13

Q.

It wasn't that we weren't

Every once in a while we would get something

Now, I want to ask you about your experience.

14

if you are or not.

15

products?

You tell me

Are you experienced with looking at intelligence

16

A.

I am.

17

Q.

Are you familiar with intelligence terms?

18

A.

Yes.

19

Q.

Do you know what an intelligence gap means?

20

A.

An intelligence gap to me is information that we do not

21

currently have.

It's lacking at that point.

22

CDC[MR. COOMBS]:

23

MJ:

Thank you, Chief.

Redirect?

7904

11454

1
2

ATC[CPT WHYTE]:

We have no questions, Your Honor.

[The witness was duly warned and withdrew from the courtroom.]

3

CDC[MR. COOMBS]:

4

and I just missed it.

5
6
7
8
9
10

MJ:

Do the parties want him

permanently excused?
CDC[MR. COOMBS]:

I’d like to have him permanently excused

just because he is OCONUS, ma’am.
TC[MAJ FEIN]:
him, ma’am.

The United States would request temporary for

We’ll keep him up to date.

MJ:

12

TC[MAJ FEIN]:

14

It might have been said

Is he a permanent excusal?

No, I temporarily excused him.

11

13

Ma’am, I’m sorry.

Why don't we -- let's go temporarily.
United States asks for a 10-minute recess in

order to get classified information out.
MJ:

The Court is in recess.

15

[The court-martial recessed at 1420, 5 June 2013.]

16

[The court-martial was called to order at 1433, 5 June 2013.]

17

MJ:

The Court is called to order.

Let the record reflect all

18

parties present when the court last recessed are again present in

19

court.

20

Are the parties ready to proceed?

21

ATC[WHYTE]:

Yes, ma'am.

22

CDC[MR. COOMBS]:

23

ATC[CPT WHYTE]: The United States calls Captain Casey Fulton.

Yes, Your Honor.

7905

11455

1

CAPTAIN CASEY FULTON, U.S. Army, was called as a witness for the

2

government, was sworn and testified as follows:
DIRECT EXAMINATION

3
4

Questions by the assistant trial counsel [CPT WHYTE]:

5

Q.

You are Captain Casey Fulton?

6

A.

Yes.

7

Q.

Captain Fulton, what is your current position?

8

A.

I'm an intelligence observer coach trainer.

9

Q.

Where are you stationed?

10

A.

At the Joint Multinational Training Center in Hohenfels,

11

Germany.

12

Q.

What are your responsibilities in that position?

13

A.

I coach, train rotational units through scenario based

14

training exercises.

15

Q.

How long have you been in that position?

16

A.

Ten months.

17

Q.

And what is your branch?

18

A.

Intelligence, military intelligence.

19

Q.

How long and military intelligence officer?

20

A.

Seven-and-a half years.

21

Q.

What initial training did you receive to become an MI

22

officer?

7906

11456

1
2

A.

I went to the Intelligence Officer Basic course and I went

to the Military Intelligence Captains Career course.

3

Q.

After the basic course, what was your first assignment?

4

A.

I was assigned to 508th STB 4th Brigade 82d Airborne.

5

Q.

And what happened when you arrived at Fort Bragg?

6

A.

I was deployed immediately to Afghanistan.

7

Q.

How long was this deployment?

8

A.

One year.

9

Q.

What was your position during that deployment?

10

A.

I was an assistant S-2 for the battalion.

11

Q.

What were your responsibilities in that position?

12

A.

My primary responsibilities were collection management, and

13

current operations.

14

Q.

So after that year what happened next, you redeployed?

15

A.

Yes, I redeployed to Fort Bragg, and then I became a

16

platoon leader in the MI Co.

17

Q.

What is the MI Co?

18

A.

The MI Company.

19

Q.

MI, military intelligence company?

20

A.

Correct.

21

Q.

How long were you at Bragg after you redeployed?

22

A.

About 9 months.

23

Q.

And what happened after those 9 months?

7907

11457

1

A.

I got orders to go to the MI Captains Career course.

2

Q.

How long was that Captains Career course?

3

A.

Four to five months.

4

Q.

What type of training did you receive at the Captains

5

Career Course?
A.

6

We learned how to do the mission analysis portion of the

We did -- we covered all the different types of intelligence

7

MDMP.

8

disciplines, handling classification information, collection

9

management.

10

Q.

Can you explain to the Court what the mission analysis is?

11

A.

It's step 2 of the military decision-making process.

12

Q.

What does that consist of?

13

A.

Step 2 is where the staff gathers all the information and

14

conducts analysis on the current conditions of the operating

15

environment.

16

Q.

Is that the intel portion of the MDMP?

17

A.

Yes.

18

Q.

What was your first assignment out of the Captain Career

19

Course?

20

A.

To 2nd Brigade 10th Mountain.

21

Q.

When did you arrive at Fort Drum?

22

A.

September 2009.

It's a big focus for the Intel section.

7908

11458

1
2

Q.

Let's talk about your time at Fort Drum in garrison.

was your position when you arrived at Fort Drum?

3

A.

I was the S-2 plans.

4

Q.

And how long were you the S-2 plans in garrison?

5

A.

I was the S-2 plans for about 2 weeks before the unit

6

What

started to deploy.

7

Q.

Where did you work at Fort Drum?

8

A.

In the SCIF.

9

Q.

How do you know PFC Manning?

10

A.

He also worked in the S-2 section in the SCIF.

11

Q.

So what were your responsibilities as S-2 plans officer in

12
13
14

garrison?
A.

I was creating the intelligence portion of the operations

order for the deployment operations order.

15

Q.

And what is the operation order for the deployment?

16

A.

It was basically the order that was going to get us into

17

theatre.

18

theatre.

19
20

Q.

The focus would have been force array once we got into

What type of information was included in the intel portion

of this order?

21

A.

The enemy threat for the area that we were assuming.

22

Q.

And who helped you create this portion of the OPORD?

7909

11459

1
2

A.

PFC Manning helped, Sergeant -- Mr. Balonek helped, Mr.

Ehresman helped.

That was about it.

3

Q.

How did PFC Manning help you with this?

4

A.

He gave me a base of knowledge on all the enemy threat

5

groups when I first got there so I could get started.

6

Q.

For the intended -- the threat groups for the intended AO?

7

A.

Yes.

8

Q.

How long were you at Fort Drum again?

9

A.

I was only there a month and a half before I deployed, but

10

I was only there 2 weeks before the unit started to deploy.

11

Q.

And where did you deploy to?

12

A.

FOB Hammer, Iraq.

13

Q.

Do you remember when you deployed?

14

A.

November 2009.

15

Q.

And did PFC Manning deploy as well to Hammer?

16

A.

Yes, he did.

17

Q.

What section within FOB Hammer did you work?

18

A.

I was in the S-2 plans in the S-2 section.

19

Q.

Can you describe how the S-2 section was organized at FOB

20

Hammer?

21

A.

We had a Current OPs section, which was in the tactical

22

operations center.

We had the S-2 plans, which consisted of myself.

23

We had a fusion cell, which had most of the analysts, the rest of the

7910

11460

1

shop with the exception of one analyst that was assigned to Chief

2

Hack, who was part of the targeting section.

3

which is the HUMINT cell, and a SIGNET section.

4
5

Q.

We also had an S-2X,

You said there was a Current OPs section.

What is current

operations?

6

A.

They handle all the current operations within an 96 hour

7

window.

8

Q.

And you said you were plans, so what was your focus?

9

A.

Anything beyond 96 hours.

I would be doing all the long

10

term plans, the intel portions of the OP orders for long term

11

operations.

12

Q.

How did the fusion cell fit in in the S-2 section?

13

A.

When we do mission analysis, you create a running estimate.

14

The fusion cell is constantly updating that running estimate.

15

what we do on a daily basis for intel.

16

plans and targeting.

It feeds current operations,

17

Q.

Where did you work when you were at FOB Hammer?

18

A.

In the SCIF.

19

Q.

Where did PFC Manning work?

20

A.

In the SCIF.

21

Q.

Let’s talk about the SCIF just really quickly.

22

access to the SCIF at FOB Hammer?

7911

That’s

Who had

11461

A.

1
2

had civilian contractors.

3
4
5

The S-2 section, the whole S-2 section, Chief Hack and we

Q.

So how did you know if someone had access to the SCIF or

A.

Well, we all knew each other within our respective areas.

not?

6

We all worked in the same room.

7

have the code to get in the door.

They’re on an access roster.

They

8

Q.

What is -- what’s an access roster?

9

A.

It’s a memorandum that lists all the individuals that have

10
11
12
13

access to the SCIF.
Q.

So what happened if someone who was not on the access

roster needed to enter the SCIF?
A.

It would depend on what classification or clearance they

14

hold, but everyone in the SCIF would be notified that a person was

15

coming in and, if necessary, the area would be sanitized to the

16

proper level of clearance that they had authorization for.

17

Q.

So what do you mean by sanitize?

18

A.

If they don’t have authorization to view classified

19

material, it would be put out of site, computers would be turned off,

20

or at least the monitors would be turned off so nothing was showing

21

so they could inadvertently have access to information they

22

shouldn’t.

23

Q.

Who was responsible for sanitizing the SCIF?

7912

11462

1

A.

All of us.

2

Q.

How often did this happen?

3

A.

We did have people come in frequently that only had a

4

Secret clearance, but anything beyond that only happened very rarely.

5

Q.

6

Hammer?

7

A.

SIPR and NIPR.

8

Q.

Can you explain the use of SIPRNET in garrison versus in

9
10
11

Which networks did PFC Manning have access to at FOB

theatre?
A.

In theatre it’s a primary method of commination, SIPR is,

while NIPR is the primary method of communication in garrison.

12

Q.

What classification level is information on SIPRNET?

13

A.

Secret.

14

Q.

What’s the presumption of information on SIPRNET?

15

A.

If it’s not marked, that it’s Secret.

16

Q.

And how do you know that?

17

A.

Because it is rule of thumb to assume a higher

18

classification.

19

Q.

Was -- how do you know that that’s the general rule?

20

A.

Training.

21

Q.

Was PFC Manning authorized to remove classified information

22
23

for personal use?
A.

No.

7913

11463

1
2

Q.

Was PFC Manning authorized to give classified information

to WikiLeaks?

3

A.

No.

4

Q.

Why not?

5

A.

Because you’re not allowed to disclose information to

6

individuals who do not have authorization to view that type of

7

material.

8

Q.

What was your position when you arrived at FOB Hammer?

9

A.

I was still in the S-2 plans.

10

Q.

And in theatre what were you responsibilities?

11

A.

As the S-2 plans?

12

Q.

Yes.

13

A.

Well, I did the intelligence portion for the operations

14

orders that we created.

15

Q.

And what type of operation orders were you creating?

16

A.

The first one that I did was for election security, which

17

is our main focus while we were there.

18

for the transition and withdraw, base closures.

19
20
21
22

Q.

I also did the intel portion

So what type of information was included in the intel

portion of the election security OPORD?
A.

Information on the Iraqi elections, how they were going to

be conducted, political groups, as well as historical data on what

7914

11464

1

has happened in the past during the elections and also current enemy

2

activity.

3
4

Q.

How many intelligence analysts worked for in S-2 plans,

work solely for you?

5

A.

None.

6

Q.

So who assisted you in creating some of this work product?

7

A.

Well, I had to request assistance from the analyst. So it

8
9
10
11
12

was generally either PFC Manning or Sergeant -- Mr. Balonek.
Q.

So how did PFC Manning specifically help you in

accomplishing your mission?
A.

I gave him projects that focused on collecting, gathering a

whole bunch of data, organizing it, and displaying it on the map.

13

Q.

Why did you ask him specifically?

14

A.

Because he was good with computers.

15

He could get it done

quicker.

16

Q.

What type of information was he pulling for you?

17

A.

Significant activities, enemy SIGACTs.

18

Q.

Do you remember what type of SIGACTs he was pulling?

19

A.

No.

I mean, we specifically usually focused on IEDs, small

20

arms, firearms and indirect fire.

21

we also focused on VBIEDs because of the elections.

22
23

Q.

Those are the three big ones, but

After you pulled this information, what would PFC Manning

do next?

7915

11465

A.

1

He'd pull it.

He would organize it, sort it, and then,

2

like I said, he would put it on the map so it was represented

3

visually.

4
5
6
7

Q.

And what is the purpose of putting this information on a

A.

That way you could conduct analysis based on the patterns,

map?

the engagement areas that are represented.

8

Q.

What type of analysis on -- what type of analysis?

9

A.

Yes. I mean, we do pattern analysis in order to identify

10

enemy activity.

11

Q.

What would you do with the work product you received from

12

PFC Manning?

13

A.

It was incorporated into product that I was working on and

14

then it was presented to the commander so that he could give guidance

15

on a course of action to be developed.

16

Q.

Did you brief the commander?

17

A.

Yes.

18

Q.

How often?

19

A.

About maybe once a week, once every 2 weeks.

20

Q.

During deployment what additional responsibilities did you

21

It depended.

take on?

22

A.

I was eventually -- I was counseled as the assistant S-2.

23

Q.

Do you remember when this happened?

7916

11466

1

A.

February.

2

Q.

Can you explain a specific task you delegated to PFC

3
4

Manning when you were the assistant S-2?
A.

Yeah.

The -- another staff section required -- they wanted

5

all the significant activity that occurred while we were in theatre

6

compiled in order to see whether the events had decreased or

7

increased while we were there.

8

SIGACTs.

So he did trend analysis on all those

9

Q.

What was the purpose of this project?

10

A.

It -- essentially to see whether SIGACTs had increased or

11

decreased while we were there in theatre, whether we had made an

12

impact on the environment.

13
14

Q.

Let’s move on to another subject.

Are you familiar with

the Apache video?

15

A.

Yes.

16

Q.

When did you first watch the Apache video?

17

A.

It was early on the in deployment.

18

It would be in the

December time frame maybe.

19

Q.

Where did you see it?

20

A.

It was displayed on Showman’s computer.

21

Q.

In the SCIF?

22

A.

Yes.

23

Q.

On what network was the video?

7917

11467

1

A.

SIPR.

2

Q.

When did you go on R and R?

3

A.

April.

4

Q.

What happened when you returned from R and R?

5

A.

I had asked the individuals in the shop if they had seen

6

the video that had been put out on the news.

7

Q.

And how did PFC Manning react?

8

A.

He came up to me after I discussed it with the Soldiers in

9
10

the shop and told me that he thought that that was the same video we
had on our shared drive.

11

Q.

What did he do next?

12

A.

Well, I told him I didn’t think it was the same video

13

because it had obviously been edited, so it didn’t look the same when

14

I saw it.

15

make that determination.”

16

videos clips -- two video clips that were labeled as the one on our

17

share drive and the one that was in the media so that I could see

18

both of the video clips.

19
20
21

Q.

I said, “No, I would have to see both videos in order to
He sent me an e-mail with a link to those

And obviously when you’re talking about -- this email -- on

what network was this email sent?
A.

SIPR.

7918

11468

1

Q.

So when we’re talking about this email obviously in an

2

unclassified setting, given our setting here.

3

receiving this email?

Do you remember

4

A.

Yes.

5

Q.

And can you explain what this email consisted of again?

6

A.

A hyperlink to the share drive.

7

Q.

What did you do when you received this email?

8

A.

I clicked on the link and I watched the videos and I

9
10

responded to them via email, surprised that it was the same -admitting that I was surprised to see that it was the same video.

11

Q.

How long after watching the video did you send this email?

12

A.

Immediately.

13

ATC[CPT WHYTE]:

I think.
Your Honor, at this time we would offer into

14

evidence what has been marked as Prosecution Exhibit 55 for

15

Identification.

16

CDC[MR. COOMBS]:

17

MJ:

18

ATC[CPT WHYTE]:

19

All right.

CDC[MR. COOMBS]:

21

MJ:

23

And also at this time, Your Honor, we’d

offer Prosecution Exhibit 56 for Identification.

20

22

No objection, Your Honor.

Okay.

Again, no objection, Your Honor.

I’ll mark them at the recess.

Questions continued by the assistant trial counsel [CPT WHYTE]:
Q.

When did you redeploy to Drum?

7919

11469

1

A.

July of 2010.

2

Q.

Did you work in the S-2 shop for the entire deployment?

3

A.

Yes.

4

Q.

Did PFC Manning work in the S-2 shop for the entire

5

deployment?

6

A.

Until I had to have him removed, yes.

7

Q.

Do you remember approximately on what date PFC Manning ----

8

A.

April.

9

ATC[CPT WHYTE]: Thank you.

Late April, maybe early May.

CROSS-EXAMINATION

10
11

We have no more questions.

Questions by the civilian defense counsel [MR. COOMBS]:

12

Q.

How are you doing, Captain Fulton?

13

A.

I'm good.

14

Q.

Good.

Just a few questions for you.

I want to start off

15

by asking you about something the government talked about when you

16

first arrived at the unit.

Okay?

17

A.

Okay.

18

Q.

And that was you were putting together an OP order for your

19

brigade?

20

A.

Correct.

21

Q.

And that OP order was basically to define the purpose of

22

the S-2 operations in relation to the brigade's mission; is that

23

right?

7920

11470

1

A.

Yes, and the operating environment we were going to.

2

Q.

And as part of that process then you would consider the

3

operation, the end state with respect to the relationship among the

4

force and also the enemy and the terrain; is that right?

5

A.

Correct.

6

Q.

And during that time there was minimal SIPRNET access

7

available?

8

A.

That's correct.

9

Q.

So you first went to the First Lieutenant Elizabeth Fields

10

to get a picture of the enemy?

11

A.

Yes.

12

Q.

And you needed that picture of that enemy as part of your

13

OP order?

14

A.

Correct.

15

Q.

When you say a picture of the enemy, you mean basically

16

kind of a general overall impression of the enemy that was operating

17

within your area of operation?

18
19
20
21
22

A.

Yes. Specifically, I was looking for the enemy threat

groups that were operating within our environment.
Q.

Okay.

So it was the different basically insurgent threat

groups as opposed to the enemy in general?
A.

Correct.

7921

11471

Q.

1
2

And you basically wanted to determine the location, the

known location, of enemy operations?

3

A.

Yes.

4

Q.

And you wanted to determine the last known activity of the

5

enemy?

6

A.

Yes.

7

Q.

Basically is he attacking, is he retreating, defending,

8

patrolling, that type of stuff?

9

A.

And their TTPs and how they operate, yes.

10

Q.

And you wanted to get an idea of strength of the enemy as

12

A.

Yes.

13

Q.

So first you went to Lieutenant Fields, she then pointed to

11

well?

14

PFC Manning as somebody who knew about the different insurgent groups

15

that were operating within the area of operation?

16

A.

Yes.

17

Q.

And you went to speak with PFC Manning?

18

A.

Correct.

19

Q.

Your conversation really wasn't very long though?

20

A.

No.

21

Q.

Basically lasted about 10 to 15 minutes?

22

A.

Maybe.

23

Q.

Do you think it lasted longer than that?

I don't know how long it lasted.

7922

11472

1

A.

No, probably not.

2

Q.

And he could basically give the names of the enemy groups

3

and whether they were Sunni or Shia?

4

A.

Correct.

5

Q.

He didn’t have a lot of details that you actually needed?

6

A.

No.

7

Q.

And basically after talking to him for that short period of

8

time then you did your own research on the enemy threat?

9

A.

Correct.

10

Q.

You spent approximately the next several hours pulling

11

information that you needed to truly identify the enemy threat?

12

A.

That's correct.

13

Q.

Now, I want to talk about your experience in working with

14

PFC Manning.

15

A.

Okay.

16

Q.

After working with him for a short period of time, you

17

Okay?

noticed that he was a junior analyst?

18

A.

Yes.

19

Q.

As a junior analyst he basically missed the so what factor;

20

is that correct?

21

A.

Yes. The analysis, usually that comes with experience.

22

Q.

So he really couldn't give you a good amount analytical

23

product that you needed?

7923

11473

1

A.

Not the analysis portion, yes.

2

Q.

And that wasn't really surprising because of the level of

3

his experience?

4

A.

Yes.

5

Q.

And really creating a good analytical product from the

6

analysis standpoint takes time to develop that skill?

7

A.

Yes.

8

Q.

It takes experience?

9

A.

Yes.

10

Q.

And PFC Manning was inexperienced?

11

A.

Correct.

12

Q.

He was still learning?

13

A.

Yes.

14

Q.

Now, he wasn't an expert analyst when it came to the

15

different insurgent groups in Iraq, was he?

16

A.

What do you mean?

17

Q.

Would you consider him an expert analyst on the different

18

insurgent groups in Iraq?

19

A.

No.

20

Q.

Would you consider him an expert analyst on the enemy

21
22

threat as a whole to the United States?
A.

No.

7924

11474

Q.

1
2

Now, even though PFC Manning was not an expert analyst at

this point, he was very good with computers?

3

A.

Correct.

4

Q.

And during the deployment, you frequently assigned him

5

computer data entry products based upon his skills?

6

A.

Correct.

7

Q.

And the skills you assigned him, they actually did require

8

computer knowledge?

9

A.

Yes.

10

Q.

And he could really do a good job of importing and

11

exporting information in Excel?

12

A.

Yes.

13

Q.

And you knew that he understood the various programs that

14

are on the DCGS system?

15

A.

Yes.

16

Q.

He also did a very good job of plotting data points on

18

A.

Yes.

19

Q.

You saw his computer skills as his real strength as a

17

20

maps?

junior analyst?

21

A.

That's correct.

22

Q.

And you used those strengths, as any officer would, to help

23

improve your S-2 products?

7925

11475

1

A.

Yes.

2

Q.

Now, within S-2 plans, you testified on direct, that it was

3

the MDMP process that you were constantly going through; is that

4

right?

5

A.

That’s correct.

6

Q.

The military decision-making process?

7

A.

Correct.

8

Q.

And you needed his assistance in pulling certain data in

9

that process?

10

A.

Yes.

11

Q.

You would ask him to take that data and put it on a map?

12

A.

Yes.

13

Q.

And then once he did that, you would actually do the

14

analysis?

15

A.

That's correct.

16

Q.

You didn't rely upon him to do the analysis?

17

A.

No.

18

Q.

And why was that?

19

A.

Well, because he was a junior analyst and I would talk

20

through the product with him as a learning point, but when it came

21

down do it, I did -- being more experienced I did my own analysis on

22

it.

23

Q.

And during the deployment you worked out of the SCIF?

7926

11476

1

A.

That's correct.

2

Q.

And my understanding, for the most part, your primary

3

mission was election security?

4

A.

Yes, for most of the deployment.

5

Q.

And you spent a large amount of time working on products

6

for election security?

7

A.

Yes, or within that operation order, yes.

8

Q.

And on direct it was essentially these products were being

9
10

used apparently for the commander to make certain decisions on
courses of action?

11

A.

That's correct.

12

Q.

Now, obviously, these products were very important for your

13

brigade?

14

A.

Yes.

15

Q.

And you assigned PFC Manning several duties to complete in

16

order to help you on the products that you needed to produce?

17

A.

Yes.

18

Q.

My understanding is you were assigning him these projects

19

pretty much on a frequent basis from November of 2009, to the time

20

that the elections happened in March of 2010?

21
22

A.

You'd have to define frequent, but there were a few

taskings, yes.

7927

11477

1

Q.

I'd like you to define frequent for me.

2

tasking him?

3

A.

How often were you

It would depend on what the project was that we were
Some were specific to his

4

working on within that time frame.

5

section.

6

were under time constraints, then I would request assistance.

7

wasn't a daily event.

Some weren't.

So if it was specific to his section and we

8

Q.

Did he work a lot for you during this time?

9

A.

I wouldn't say a lot.

10
11

It

He was the analyst that I went to

when I needed assistance, but I did a lot of it on my own.
Q.

I know it's taking you back a few years, but for the

12

military judge, would you give an approximation of how often would

13

you task him?

14
15

A.

I don't know if I would even be able to give you an

approximate number of times.

16

Q.

And that's just due to the time period that's gone on?

17

A.

I don't remember how many times he was tasked.

18

Q.

Safe to say he worked for you?

19

A.

On occasions.

20

Q.

We'll he go with that.

21

When he was assigned tasks he

completed those tasks?

22

A.

Yes.

23

Q.

And he completed those tasks in a timely fashion?

7928

11478

1

A.

Yes.

2

Q.

You never noticed a drop in his performance, did you?

3

A.

No, not in the stuff that I assigned him, no.

4

Q.

And did anyone ever come to you and say that PFC Manning’s

5
6
7
8
9
10

performance had dropped?
A.

No, not specifically -- there was discussions about certain

things, but not analytical performance, no.
Q.

All right.

came out on direct.

Now, let's talk about one of the things that
You mentioned that PFC Manning was tasked to do

a trend analysis of SIGACTs for the brigade?

11

A.

Yes.

12

Q.

What was this project again?

13

A.

It was essentially it just supposed to show increase and

14

decrease over time since we've been in theatre, whether SIGACTs had

15

increased or decreased since we were there.

16

Q.

And how would PFC Manning create a product like that?

17

A.

He pulled all the SIGACTs from CIDNE, organized them on an

18

Excel spreadsheet and then you can use the charts with an Excel

19

spreadsheet is to create, show, identify trends.

20
21
22

Q.

And I imagine what was of use and benefit was not only

pulling that data but also indicating what type of SIGACT it was?
A.

Yes.

Organizing it, yes.

7929

11479

1

Q.

2

SIGACT?

3

A.

Yes.

4

Q.

Or enemy engagement?

5

A.

Yes.

6

Q.

Or civilian death?

7

A.

Yes.

8

Q.

And PFC Manning had reviewed those SIGACTs in order to

9

So that would identify in it was an enemy threat type

create the product?

10

A.

Correct.

11

Q.

I want to ask you about analytical products in general. Are

12

you familiar with the term intelligence gap?

13

A.

Yes.

14

Q.

And when would you call something an intelligence gap?

15

A.

When you don't have any information.

16

Q.

You're familiar with the term assumption in the

17

intelligence work product?

18

A.

Yes.

19

Q.

And what would you call when would you call something an

20
21
22

assumption?
A.

When you don't have the information, but you think it might

be a certain way.

7930

11480

1
2

Q.

And as soon as you actually have kind of actual knowledge

of that fact would you call it an assumption?

3

A.

I don't understand the question.

4

Q.

If you have actual knowledge of a fact, would you call

5

something an assumption in a work product?

6

A.

Facts and assumptions are separated.

7

Q.

And if you have actual knowledge of something would you

8

call it an intelligence gap?

9

A.

No.

10

Q.

In the January to May 2010, time frame did your unit have

11

any actual knowledge as to which websites enemies went to get

12

information?

13

A.

I don't remember.

14

Q.

Did you ever remember anything being put out that this

15

particular website is where the enemy goes?

16

A.

Like their own websites or just websites in general?

17

Q.

The latter.

18

A.

General knowledge that they visit, you know, all sorts of

19

websites seeking information, but.

20

Q.

But any actual knowledge as to which websites?

21

A.

For operational security purposes they -- you know, you’re

22

frequently briefed on Facebook and social networking sites that

7931

11481

1

obviously a lot of people put personal information on.

2

Google maps.

3

Q.

Potential information where they might go?

4

A.

Yes.

5

Q.

Anything where there's actual confirmation they may go to

6

They've used

this website?

7

A.

Not that I know.

8

Q.

Are you familiar with a program mIRC Chat?

9

A.

Yes.

10

Q.

And are you familiar with the term executable file?

11

A.

No.

12

Q.

How was mIRC Chat put on your computer?

13

A.

I don't remember.

14

Q.

Was it -- when you say you don't remember, was it part of

15

your computer when you got there?

16

A.

No, I don't think so.

17

Q.

How did you use mIRC Chat on your computer?

18

A.

It was on the desktop.

19

Q.

Did you have to click on it -- double click it to get it to

20

The icon was on the desktop.

opened up and run?

21

A.

Yes.

22

Q.

You don't recall who put that on your computer?

23

A.

No.

7932

11482

1
2

Q.

Let's discuss the SIGACTs for a moment.

After PFC

Manning's arrest, did your unit continue to use SIGACTs?

3

A.

Yes.

4

Q.

Was there ever a time in which your unit didn't have access

5

to the CIDNE Iraq database that had SIGACTs?

6

A.

No.

7

Q.

Since PFC Manning's arrest, has there ever been anything

8

put out that says don't use any SIGACTs that predate January 2010?
A.

No.

10

MJ:

Yes.

11

ATC[CPT WHYTE]:

12

MJ:

13

CDC[MR. COOMBS]:

14

MJ:

9

15
16

Relevance.

Same as before, 641, is that correct.?
Yes, Your Honor.

Go ahead.

Questions continued by the civilian defense counsel [MR. COOMBS]:
Q.

Did you and the other analysts continue to use SIGACTs that

17

predated January 2010, in the same way that you did after PFC

18

Manning's arrest?

19
20
21

A.

I'm sorry, are you asking if we use SIGACTs from before

January of 2010?
Q.

In the same manner that you did -- I'm actually asking

22

before PFC Manning's arrest and then after, did you change the way

23

you used SIGACTs?

7933

11483

1

A.

No.

2

Q.

You talked about the Apache video.

My understanding is

3

when you came back and you said you didn't think that was the same

4

video and then basically you told PFC Manning to prove it to you by

5

sending you the video?

6

A.

No.

I said that I would have to see the video back to back

7

in order to be able to make that determination, because I had seen

8

both video clips, I had seen at separate times.

9

very closely.

One I had seen not

So I wasn't sure -- to me it looked like they weren't

10

the same video, but again I was just saying I would have to say both

11

videos again back to back to make that determination.

12

Q.

And after saying that PFC Manning sent you the video?

13

A.

Correct.

14

Q.

At the time that he said that it was the same video or

15

after sending you the video, did he act in any way that was boastful

16

or bragging or anything like that?

17

A.

No.

18

Q.

With regards to just analysts in general, an all source

19

analyst, can they look at anything they want to on the SIPRNET?

20

A.

Just about, yes.

21

Q.

Would you discourage an all source analyst from basically

22

from basically kind of like surfing the SIPRNET on their free time

23

just to see what's there as learning information?

7934

11484

1

A.

2

development.

3

Q.

4

the SIPRNET?

5

A.

Because intelligence, you know, and enemy threat groups are

6

global.

So although we have a mission specific enemy that we should

7

be focused on, for professional development purposes they could learn

8

about other enemy threat groups.

9

Q.

No, as long as it was in the realm of professional

Why would you not discourage an analyst for just surfing

So if you saw PFC Manning surfing the Internet and looking

10

at various places on the SIPRNET and pulling information just kind of

11

organizing it for his professional development, you wouldn't have a

12

problem with that?

13

A.

14

CDC[MR. COOMBS]:

15

MJ:

18

For his professional development, no, I wouldn't.
Thank you.

Redirect?
REDIRECT EXAMINATION

16
17

Yes.

Questions by the assistant trial counsel [CPT WHYTE]:
Q.

Captain Fulton, let's just talk briefly about intelligence

19

gap, what that actually means. Can you give maybe just an

20

unclassified example of what could be an intelligence gap?

21

A.

Frequently intelligence gaps are identified during the

22

mission analysis portion of the MDMP.

23

example of an intel gap is frequently is the enemy logistics.

7935

What I would think is a good
We

11485

1

know they're bringing weapons, we don't know where, how, or when.

2

we make some assumptions and then we put collection assets on our

3

assumptions to confirm or deny.

4

Q.

5

CDC[MR. COOMBS]:

6

MJ:

7

So you know the enemy is bringing in weapons?

Overruled.

Objection, leading.
She just responded to that.

Go ahead.

[Examination of the witness continued.]

8

Q.

So you know that the enemy is bringing in weapons?

9

A.

Yes.

10

Q.

In this hypothetical?

11

A.

Yes.

12

Q.

What else do you know, for instance, about the enemy in

13
14

this hypothetical?
A.

I mean, it varies.

So that's, you know, they're bringing

15

them in, you know, that they have to be, you know, coming from

16

somewhere.

17

methodology associated with their activities and you may not know

18

what that is and so you just -- you confirm or deny in order to

19

continually fill that gap.

20
21

So

Q.

They have to be doing it at certain times.

They have a

And just lastly on cross the defense asked you:

Did you

ever -- would you discourage a Soldier from surfing the SIPRNET?

22

A.

For professional development purposes?

23

Q.

Yes.

Did you ever surf the SIPRNET?

7936

11486

1

A.

2

theatre, no.

3

Q.

Why not?

4

A.

I didn't have time.

5

Q.

And also for the Apache video, you said you were surprised

6
7
8

For professional development purposes, not while in

when you ended up seeing it.
A.

Why were you surprised?

Because what I had seen the media put on the news didn't

look at all like the same when I saw it.

9

Q.

What about because of where you saw it previously?

10

A.

Yes.

11

ATC[CPT WHYTE]: No more questions, Your Honor.

12

MJ:

13

CDC[MR. COOMBS]:

14

MJ:

15

ATC[CPT MORROW]:

All right.
Nothing, Your Honor.

Temporary or permanent excusal?

Temporary?

Yes, ma'am.

16

[The witness was duly warned, temporarily excused and withdrew from

17

the courtroom.]

18

MJ:

Counsel, do we have anything else to present today?

19

CDC[MR. COOMBS]:

20

TC[MAJ FEIN]:

21

MJ:

No, Your Honor.

No, Your Honor.

As I announced yesterday, due to logistics issues, we’re

22

going a little faster than we anticipated and some issues that the

23

parties need to work logistically.

7937

We’re going to put the Court in

11487

1

recess until 0930 on Monday morning.

2

that we have been having all along, start up at 0930, go until about

3

-- we’re running early today, but 5:30 or 6:00 in the afternoon.
Is there anything else we need to address?

4
5

CDC[MR. COOMBS]:

6

TC[MAJ FEIN]:

7

MJ:

8

We’ll have the same schedule

No, Your Honor.

No, ma'am.

Court is in recess.

[The court-martial recessed at 1512, 5 June 2013.]

7938

11488

1
2
3
4

[The court-martial was called to order at 0943, 10 June 2013.]
MJ:

Court is called to order.

Major Fein, please account for

the parties.
TC[MAJ FEIN]:

Your Honor, all parties when the court last

5

recessed are again present with the following exceptions:

6

Robertshaw, Court Reporter, is absent; Mr. Chavez, Court Reporter who

7

has been previously sworn is present; Captain Overgaard is absent,

8

and Captain Morrow and Captain Whyte are present.

9

MJ:

All right.

Thank you.

Mr.

Let's begin with any housekeeping.

10

Have we had anything marked as an appellate exhibit, or a prosecution

11

exhibit, or a defense exhibit?

12

TC[MAJ FEIN]:

Yes, ma'am.

May I have a moment?

Your Honor,

13

first the parties agreed to a stipulation of expected testimony from

14

Mr. Steven Buchanan, dated 9 June 20133 and this has been marked as

15

Prosecution Exhibit 69 for Identification.

16
17

MJ:

All right.

PFC Manning, do you have a copy of Appellate

Exhibit 69, or Prosecution Exhibit 69, I’m, sorry ----

18

ACC: Yes, Your Honor.

19

MJ:

---- in front of you?

And we have had this discussion on

20

other stipulations of expected testimony and will have this

21

discussion probably several times again I believe in the course of

22

this court-martial, but with this particular stipulation of a Mr.

23

Steven Buchanan dated 9 June 2013, it consists of four pages.

7939

11489

1

Is that your signature on the last page?

2

ACC: Yes, ma'am.

3

MJ:

4

ACC: I did, Your Honor.

5

MJ:

6

ACC: Yes, ma'am.

7

MJ: Before signing this stipulation, did your defense counsel

8
9

Before signing this stipulation did you read it thoroughly.

Do you agree with the contents of the stipulation?

explain the stipulation to you?
ACC: Yes, ma'am.

10

MJ:

11

ACC: No, Your Honor.

12

MJ: Do you understand that you have an absolute right to refuse

13

Do you have any questions about the stipulation?

to stipulate to the contents of this document?

14

ACC: I do, Your Honor.

15

MJ: Do you understand you should enter into this stipulation

16

only if you believe it's in your best interest to do that?

17

ACC: Yes, Your Honor.

18

MJ: And once again, I want you to understand how this

19

stipulation is going to be used.

It's a stipulation of expected

20

testimony, and what that means is when counsel for both sides and you

21

agree to a stipulation of expected testimony, you are agreeing that

22

if Mr. Steven Buchanan were here in court sitting on the witness

23

stand that Mr. Buchanan and under oath, that Mr. Buchanan would

7940

11490

1

testify substantially as to what is in this stipulation of expected

2

testimony?

3

ACC: Yes, Your Honor.

4

MJ:

All right.

And his testimony can be contradicted, attacked

5

or explained the same way as if he was testifying here live in court,

6

and you are not admitting to the truth of the person's testimony?

7

ACC: Yes, ma'am.

8

MJ:

9
10

And knowing what I told you and what your defense counsel

earlier told you about this stipulation, do you still want to enter
into this stipulation of expected testimony?

11

ACC: Yes, ma'am.

12

MJ:

13

content?

Counsel for both sides agree to the stipulation and its

14

TC[MAJ FEIN]:

15

DC[MAJ HURLEY]:

16

MJ:

17

TC[MAJ FEIN]:

All right.

Yes, ma'am.
Yes, ma'am.
Prosecution Exhibit 69 is admitted.
Your Honor, also on 5 June 2013 what has been

18

marked as Appellate Exhibit 564, United States filed its witness list

19

order and proposed stipulations for the prosecution witnesses for the

20

remainder of the government's case in chief.

21
22

MJ:

All right.

As I understand it, the parties are still

working on some of those stipulations?

7941

11491

TC[MAJ FEIN]:

1

Yes, ma'am.

Although there are many stipulations

2

that are annotated by both parties on this filing, we are working and

3

probably the next recess we'll have many more of these signed and

4

ready for the court to go over with the accused.
CDC[MR. COOMBS]:

5

And, Ma'am, as part of the 802 session we

6

discussed that if the government were to add anyone on to this list

7

they would give the defense a 24-hour notice.
TC[MAJ FEIN]:

8
9

Yes, ma'am.

And the United States acknowledges

that.

10

MJ: All right.

11

TC[MAJ FEIN]:

Any other housekeeping matters?
Yes, ma'am.

Ma'am, as of this morning the media

12

operations center consists of 11 journalists and two stenographers.

13

The theater is not currently being used.

14

also not currently being used although available and up to 30 seats.

15

MJ:

All right.

And the overflow trailer is

And once again, for the record, up to this

16

point in time at the trial have any members of the public been

17

specifically excluded based on the Court's order?

18

TC[MAJ FEIN]:

19

MJ: All right.

20

No, ma'am.
Thank you.

Does defense have any reason to

disagree?

21

CDC[MR. COOMBS]:

22

MJ:

23

TC[MAJ FEIN]:

No, Your Honor.

Any other matters for housekeeping?
No, ma'am.

7942

11492

1

CDC[MR. COOMBS]:

2

MJ:

All right.

No, Your Honor.
The government proposed trial schedule plan, I

3

announced at the beginning of the trial that we would try it out for

4

a week and see how it worked.

5

because we recessed early, but that's at Appellate Exhibit 551.

6

There was no defense objection.

7

trial plan, certainly it may be modified as we go along depending on

8

necessity, but for now it provides a good rough schedule on how we

9

will proceed.

We had a little fluctuation last week

The Court will approve that proposed

The usual starting 0930 in the morning, ending

10

approximately 15 -- or at 5:30 or 6:00 o'clock at night depending on

11

the status of the particular witness who is on the stand.

12

with Appellate Exhibit 551?

13

CDC[MR. COOMBS]:

14

TC[MAJ FEIN]:

15

MJ:

All right.

Any issues

No, Your Honor.

No, ma'am.
Next we have Appellate Exhibit 563 and, for the

16

record, counsel and I entered into a R.C.M. 802 conference this

17

morning.

18

and logistics that arise in cases.

19

was any changes to the government's witness list that Mr. Coombs and

20

Major Fein just addressed.

21

Exhibit 563, I had -- which is the -- a request from the Freedom of

22

the Press Foundation that was addressed to myself and Major General

23

Linnington who is the Commander of the United States Military

Once again, that's a conference where I discuss scheduling
One of the issues that came up

Another issue that came up was Appellate

7943

11493

1

District of Washington with respect to credentialing two

2

stenographers to -- an overlap of two stenographers to report, to

3

create an unofficial transcript of this trial which they intend to

4

broadcast that will be available to all media outlets and the public

5

is what this letter tells me.

6

the defense wished to put their position on the record.

7

like to do that?

8

CDC[MR. COOMBS]:

Mr. Coombs advised me by email that

Yes, Your Honor.

Just briefly.

Would you

We believe

9

that this enforces PFC Manning's Sixth Amendment right to a public

10

trial and also impacts on a First Amendment right for the press to

11

accurately keep track of what happens in the court-martial.

12

understanding is that the government now is assuring that the

13

stenographers will have access during non-peak times, and then during

14

peak times they are looking into whether they'll have access at the

15

MOC or not.

16

peak they're going to be given an access pass instead of credential

17

passes.

18

whether or not the government can accommodate the request to have one

19

of the stenographers come in at 0700 and another come in during the

20

afternoon session to where we don't have a requirement for both of

21

the stenographers to be present the entire day.

22

MJ:

Our

It appears that regardless of whether it's peak or non-

And then I know that we still have an outstanding issue on

All right.

Major Fein, would you like to be heard?

7944

11494

1

TC[MAJ FEIN]:

Ma'am, the United States after the R.C.M. 802

2

and based off what the defense has asked owes the Court and defense

3

some answers to questions.

4

as an area for a stenographer versus the media operations center and,

5

second, the logistics of actually having an individual escorted on or

6

off post and we'll get both those questions answered today, Your

7

Honor.

8
9

MJ:

All right.

One is, can the overflow trailer be used

Thank you.

Just for the record, while the

Court is not interested in getting into the area of who is

10

credentialed and who isn't credentialed as it's beyond the scope of

11

this trial, the Court does note and so advised the parties in the

12

R.C.M. 802 conference that the Rules for Court-Martial are not

13

structured to provide a contemporaneous transcript of proceedings.

14

In light of the public interest in this case, in light of the unique

15

circumstances of this case, in light of the assertion by PFC Manning

16

that this stenographer procedure will further his rights to a Sixth

17

Amendment right to a public trial and also obviously further the

18

public's First Amendment right to a public trial, the Court has

19

ordered the government to arrive at some kind of accommodation to

20

allow stenography of the proceedings of this trial and the creation

21

of, I guess what their intent is an unofficial transcript, certainly

22

not an official transcript, the government's not doing it.

23

government's in the process of making that arise.

7945

So the

And just for the

11495

1

record, this rule or this guidance of the Court can always be

2

reconsidered should there be a violation of the Rules of Court with

3

respect to audio broadcasting or visual broadcasting once these

4

procedures are put into place.

5

this issue any further?

6

CDC[MR. COOMBS]:

7

TC[MAJ FEIN]:

8
9
10

Does either side desire to address

No, Your Honor.

No, ma'am.

Ma'am, before we go on, could we

please correct one Appellate Exhibit for the record?
MJ:

Certainly.

TC[MAJ FEIN]:

Earlier the Court when discussing the

11

government's proposed trial schedule plan referenced Appellate

12

Exhibit 551.

13

plan is 553 Alpha.

The actual proposed court -- proposed trial schedule

14

MJ: All right.

15

CDC[MR. COOMBS]:

16
17
18

Does the defense agree?
I'll have to take Major Fein's word for it,

ma'am, I don't have the appellate exhibits in front of me.
MJ: All right.

553 Alpha and that's the government's proposed

trial schedule dated 21 May 2013.

19

TC[MAJ FEIN]:

20

MJ:

Okay.

Is that correct?

Yes, Your Honor.

That's the Court's mistake.

The Court is prepared

21

to rule on the request for public access or in the alternative motion

22

to intervene to vindicate right to public access.

7946

11496

On 3 June 2013, the Court received Appellate Exhibit 558, a

1
2

proposed motion to intervene under Rules for Court-Martial 806(a),

3

(b) and (c) by three individuals who are not parties to the trial.

4

Neither the government nor the defense have moved to file Appellate

5

Exhibit 558 as a motion with the Court.
Findings:

6

One, the proceedings have been open to the
The Court has made

7

public since the start of the trial.

8

particularized findings as required by R.C.M. 806(b)(2) with respect

9

to those portions of the trial that must be closed to protect

10

classified national security information, Appellate Exhibit 550.

11

Two, neither the Court nor anyone acting pursuant to order

12

of the Court has specifically excluded any person from observing the

13

proceedings either in court or in a designated overflow area.

14

Three, reasonable policies and procedures for media



15

registration and credentialing have been established and published by

16

the Military District of Washington as set forth in Appellate Exhibit

17

561.

18

Four, R.C.M. 806(c) prohibits photography and broadcasting

19

to include video and audio recording, the taking of photographs and

20

radio and televised broadcasting of the trial.

21

Five, the two parties to this trial are the United States

22

and PFC Manning.

Unless authorized by the Rules for Court-Martial,

23

or in special circumstances recognized by the Court of Appeals for

7947

11497

1

the Armed Forces, only parties to the trial have standing to file

2

motions to be considered by this Court.

3

Appeals for the Armed Forces, 1997.

ABC Inc. v. Powell, Court of

Ruling, the Court declines to consider Appellate Exhibit

4
5

558 as it is from three individuals who are not parties to the trial

6

and who under the circumstances lack standing to file a motion with

7

the Court.

8

line.
Is there anything else we need to address at this point

9
10

I'll have this marked as the next appellate exhibit in

before going forward with the merits of the trial?

11

CDC[MR. COOMBS]:

12

TC[MAJ FEIN]:

13

MJ:

14

TC[MAJ FEIN]:

15

No, Your Honor.

No, Your Honor.

Government, proceed.
Ma'am, the United States offers Mr. Buchanan's

stipulation to be read into the record.

16

MJ:

Proceed.

17

TC[MAJ FEIN]:

Stipulation of Expected Testimony, Mr. Steven

18

Buchanan, 9 June 2013.

19

counsel and trial counsel that if Mr. Steven Buchanan were present to

20

testify during the merits and presentencing phases of this court-

21

martial he would testify substantially as follows:
I work as a contractor for the National Security Agency,

22
23

It is hereby agreed by the accused, defense

NSA.

I provide support to Intelink.

7948

Intelink is a software suite

11498

1

operating on U.S. government private networks which provides

2

Internet-like services to enable collaboration between intelligence

3

agencies within the United States Government.

4

a web-based search engine of Unclassified, Secret and Top Secret

5

information systems.

6

sharing files and searching for Unclassified, Secret and Top Secret

7

information across agencies, to include Intellipedia for online

8

collaboration and passport account management.

9

Primarily it includes

It hosts blogs and allows for messaging,

In my current position I provide security for Intelink and

10

serve as the Information Assurance IA manager.

11

make sure the systems work as they were intended.

12

the systems are properly maintained and guard against their misuse. I

13

have worked in this role for 5 years.

14

This means that I
I work to ensure

Prior to holding my current position from 1999 to 2008, I

15

was an Information Systems Security Engineer for Intelink.

16

position I made sure the systems were built correctly to perform

17

their intended connection, search and storage functions.

18

I worked in systems support within the Intelligence community, IC.

19

In total I have worked in the IA industry supporting different

20

agencies in the IC since 1985.

21

In this

Before that

I have two primary IA and information systems

22

certifications -- excuse me -- certifications.

23

Certified Information Systems Security Professional, CISSP.

7949

First, I am a
This

11499

1

means I've heightened experience in the knowledge of information

2

security.

3

that confirms an individual's knowledge in the field of information

4

security.

5

security including personnel and building securities aspects.

6

indicates that an individual has attained specialized knowledge in

7

the field of IA in accordance with standards articulated and in

8

Department of Defense Directive 8570.

9

have the Information Technology Infrastructure Library, ITIL,

CISSP is a globally recognized standard of achievement

This -- The training covers all parts of information

In addition to CISSP I also

10

foundation certification.

11

for IT service management in the world.

12

technology systems management, particularly on how to build

13

information management systems and manage them with a specific

14

process.

15

CISSP

ITIL is the most widely adopted framework
ITIL provides a framework on

In my role as an IA manager for Intelink, I am familiar

16

with the audit logs created by Intelink.

The Intelink System

17

obtains, manages, and stores its own audit data through the course of

18

its day-to-day operations.

19

user inquiries, troubleshoot technical problems, and monitor and

20

maintain Intelink usage and performance.

21

anytime anyone makes a connection with a computer system.

22

detects these connections from servers, tracking the work station

23

making the request of the system, how requests route through the

This data be can be used to respond to

7950

These logs are created
The system

11500

1

system, and where the request ultimately gets the information.

2

connection logs are made in real-time and stored in data files every

3

hour.

4

people have access to them.

5

captured from proxy servers that control access to Intelink services

6

and show the activities of users in that connect to and use the

7

Intelink services while in classified and unclassified networks.

They are computer generated and only a very limited number of
Intelink logs contain audit data

We know that Intelink logs are accurate for several

8
9

These

reasons:

First, they write to a secure server; second, only

limited

10

personnel have access to them; third, they are reviewed by our team

11

at least on a weekly basis to ensure that the reporting processes are

12

occurring properly, meaning to ensure that the log data is being

13

written properly.

14

how our services are being used, whether Intelink services are

15

functioning properly and whether adjustments should be made.

16

also use the data to solve technical issues, determine security risks

17

and review data trends that help us develop our management

18

strategies.

19

logs normally collect would be missing.

20

corrupted while being written, it would not open.

21

corrupt data files, excuse me, missing or corrupt data files are

22

regenerated from the system, so in short the data these systems logs

23

have captured is complete and accurate.

The log data is useful to us because it shows us

We can

We can tell if there are errors because information the

7951

If a data file has been
Missing or

11501

I am involved in this case because we received a request to

1
2

pull Intelink audit logs given Intelink could have been used to

3

gather information that was ultimately compromised.

4

did not track users by log-in identifiers.

5

by IP address.

6

excuse me, ma'am, Secure Internet protocol routing network, SIPRNET,

7

IP address 22.225.41.22 and 22.225.41.40 from October 2009 to June

8

2010.

9

pull the requested log I performed a Linux search on the server.

At that time we

Instead, we tracked usage

One of the log data requests was from the Secret or

Intelink audit logs are stored on a Linux based system.

To

10

This means that I issued a line command telling the server what

11

information I wanted to read.

12

system writes the data to a file.

13

could find no relevant information in the data files for October 2009

14

or June 2010.

15

IP addresses for the months November 2009 through and including May

16

2010.

17

relevant IP addresses during October of 2009, and then ran the search

18

again to verify the results.

19

the results of my original search.

20

automatically as a .TXT file so they are readable to the person

21

running the query.

22

I opened the file to make sure it was readable and that all the data

23

had been reported properly.

When the system returns the data, the
In reviewing the files returned I

However, there was activity recorded for the relevant

I double-checked to make sure there was no activity from the

The results of the second search match
The results are saved

When I received the response to my IP data query,

I did not alter the file in any way.

7952

I

11502

1

burned the file to a CD and then turned it over to Special Agent Mark

2

Mander with Army CID.

3

Exhibit 61 for identification.

4

have attested to showing activity for IP addresses, excuse me, IP

5

address 22.225.41.22 are the following:

6

and ND09_22.log.

7

attested to showing activity for IP address 22.225.41.40 are the

8

following:

9

JF10_22.log contains audit logs capturing data for the 22.225.41.22

These logs are on the CDs marked Prosecution
The file names on Intelink logs I

JF10_22.log, MAM10_22.tex,

The file names of the Interlink logs that I

JF10_40.log, MAM10_40.txt, ND09_40.log.

The file

10

IP address in January and February 2010.

11

contains audit log -- audit logs capturing activity for the

12

22.225.41.22 IP address in March, April and May 2010.

13

ND09_22.log contains audit logs capturing activity for the 22.20 --

14

225.41.22 IP address in November and December 2009.

15

file name structure to capture the contents of the audit logs

16

associated with the 22.225.41.40 IP address.

17

The file MAN10_.txt

The file

I used the same

The particular log data I captured reported several things.

18

I will use the following discrete line of data to show by way of

19

example what the Intelink logs mean.

20

22.225.41.40

21

29/November/2009:05:50:10+0000\”GET/Intelink.WIP.ISMC.Sgov.gov/webres

22

ource.AXT?D=AZ7KDRRCQCLTV13ZGP21NQ2&T=633627756757031250 HTTP/1.1”200

23

-- excuse me 200

7953

Excuse me, Your Honor.

11503

1

6665”HTTP://www.intelink.sgov.gov/search/dfault.ASPX?Q=HQDA”

2

“Mozilla/5.0%20(Windows; -- excuse me, Your Honor,

3

%20U;%20Windows%20NT%205.1;%20EN-

4

US;%20RV:1.9.1.2)%20GECKO/20090729%20FIREFOX/3.5.2) (_).

5

Your Honor, - not _.
Paragraph 8.

6

Excuse me,

The significance of the above line that was

7

pulled from Intelink is the following:

8

address.

9

request for information.

The “22.225.41.40” is the IP

This indicates that a computer with the IP address made the
Essentially it provides an electronic

10

location for the user using Intelink.

The

11

“29/November/200:04:50:10+0000” is a date time/group.

12

is reflected as the offset from the Greenwich Mean Time, GMT.

13

this case “+0000” shows no offset.

14

user took.

15

Honor, you see “GET”.

16

particular information on SIPRNET through Intelink.

17

reflects the user clicking on something in the website.

18

entry is the web page, excuse me, the page being requested by the

19

action above.

20

“/Intelink.WIP.ISMC.sgov.gov/webresource.AXD?D=AZ7KDRRCQCLTV13ZGP21NQ

21

2&T=63362776 -- excuse me.

22

633627756757031250 HTTP/1.2”.

23

registered name for Intelink which is on the SIPRNET, a Secret

The time zone
In

The next entry is the action the

In this case, for example, you see “W -- Excuse me, Your
This command indicates the user is seeking
The action
The next

Here it is,

Your Honor, I'll repeat this number Intelink . -- WIP.ISC.sgov.gov is the

7954

11504

1

government system.

The code of numbers for all -- excuse me, for the

2

information tells you whether the user's request was successful and

3

to what degree.

4

information indicates that an Internet home page, HTTP, was

5

successfully accessed.

6

information returned by the query.

7

“HTTP://WWW.Intelink.sgov.gov/search/default.ASPX?Q=HQDA” tells me

8

the user searched for the term, “Head -- HDQA” on Intelink.sgov.gov.

9

“WWW.Inteling.sgov.gov” in the SIPRNET Internet address for the

For example, the code, “200”, after particular

The “6665”, is the size in bytes of the
The entry

10

Secret government system on which Intelink sits.

In this entry

11

“search” is a specific Intelink service used and “Q=HDQA”, represents

12

the search query entered into the search box on the Intelink web page

13

on the specific computer with the IP address listed above.

14

entry, “Mozilla/5.0”, tells me the user of the SIPRNET computer with

15

an IP address “22.225.41.40” was using version 5 of the mozilla

16

Internet browser.

17

software -- browser software similar to Microsoft Internet Explorer

18

or Apple safari.

19

entry, “Windows;%20U --

20

;%20Windows%20NT%205.1;%20EN/US;20RV:1.9.1.6)”, tells me

21

the SIPRNET computer with an IP address of

22

a Windows NT work station computer.

23

entry”%20gecko/20090729%20Firefox/3.5.2” “-“ “tells me that the user

The

Mozilla is a company that produced Internet

The entry %20 represents a space in the line.

7955

The

the user of

“22.225.41.40” was using

The

11505

1

of the SIPRNET computer with an IP address “22.225.41.40” was using a

2

version of the Firefox Internet browser version number “3.5.2”.

3

Firefox is a specific name of the Internet web browser program

4

produced by the mozilla company.

5

These Intelink logs only audit what happens on the Intelink

6

system, so it can only tell you what a particular user IP address was

7

doing when connected with the Intelink system.

8

Intellipedia searches and other ways the user's IP address used

9

Intelink searches by showing what files within Intelink that IP

It would reveal

10

address accessed.

At the time, users were not required to have

11

Intelink passport accounts to use most Intelink services, including

12

the SIPRNET Internet search and browsing.

13

passport account is a user name and password account established to

14

allow access to some government websites.

15

applications Intelink uses on its own internal systems to track what

16

a user accesses.

17

contribute to Intelink services or access certain websites or

18

databases on SIPRNET, but not just to conduct searches.

19

account a user would have to be on the SIPRNET, go to the account

20

creation page and insert personal information such as name, contact

21

and organizational information.

22

SIPRNET email with a code to use the first time he accesses the site.

23

Other government organizations or websites and databases on SIPRNET

A SIPRNET Intelink

It is one of the many

A user would need an account if he wanted to

To create an

The user is then notified via

7956

11506

1

use SIPRNET Intelink passport accounts to verify users before any

2

user may access their information on SIPRNET.

3

organization maintains and stores Intelink passport account profiles

4

of registered Intelink users.

5

I looked Bradley Manning up in our system.

6

“Manning,Bradley E” did have an account.

7

individual was, “Bradley.E.Manning”.

8

“Bradley.E.Manning”, was in the military.

9

used an email address of “Bradley.Manning@US.Army.smil.mil.”

Our Intelink

In a response to a request by Army CID
Someone with the name,
The user name of the

According to the user account,
His pay rate was E4 and
The

10

user name is automatically generated based on a common name used by

11

the individual setting up the account.

12

identifies each identifying factor such as name, contact information

13

security questions and answers.

14

system at the time the account -- of the account creation.

15

to the passport account, the last time the user logged in was 27

16

April 2010 at 1805 and 46 seconds Zulu time.

17

passport account the registration date was 11 October 2008.

18

password account information is marked as PE 62 for Identification.

19

I signed an attestation on 22 June 2010, Bates Number 00505257

20

attesting to the authenticity of what have been marked as PE 61 and

21

PE 62 for Identification and are the provided logs in the Intelink

22

password account information for “Bradley.E.Manning” contained in the

23

file “Manning.LDIV”.

The user information includes

That the user inputed into the

7957

According

According to the
The

11507

1

Your Honor, the United States moves to admit Prosecution

2

Exhibit 61 and 62 for Identification as Prosecution exhibit 61 and

3

62.

4

DC[MAJ HURLEY]:

5

MJ:

6

TC[MAJ FEIN]:

No objection, ma'am.

All right.

May I see -- Is Prosecution Exhibit 61 a CD?
Your Honor, Prosecution Exhibit 61 is two CDs.

7

CD 1 of 2 and 2 of 2.

8

a quick moment?

9

[There was a brief pause while the trial counsel consulted with

10
11
12
13

MJ:
admitted.

Yes.

All right.

Prosecution Exhibits 61 and 62 are

Handing it back to the court reporter.
Government, are you ready to proceed?

TC[MAJ FEIN]:

15

ATC[CPT MORROW]:

17

Your Honor, may I have

assistant trial counsel.]

14

16

And 62 is a printout.

Yes, ma'am.
Your Honor, the United States recalls

Special Agent David Shaver.
[END OF PAGE]

18

7958

11508

1

SPECIAL AGENT DAVID SHAVER, U.S. Army, was recalled as a witness for

2

the prosecution, was reminded he was still under oath, and testified

3

as follows:
DIRECT EXAMINATION

4
5

Questions by the assistant trial counsel [CPT MORROW]:

6

Q.

Special Agent Shaver, you are still under oath.

7

A.

Yes, sir.

8

Q.

Agent Shaver, I want to begin by talking about some SIPRNET

9

Intelink logs collected as part of this case, but first I need to ask

10

a few preliminary questions.

Did you examine any SIPRNET computers

11

associated with PFC Manning as part of this investigation?

12

A.

Yes, sir, I did.

13

Q.

And what were the IP addresses of those computers?

14

A.

They were ending in .22 and .40.

15

Q.

And again for the record, what is an IP address?

16

A.

That's like a telephone number for a computer.

17

Q.

And are you familiar with Intelink?

18

A.

Yes, sir, I am.

19

Q.

And what is Intelink?

20

A.

It's Google of the SIPRNET.

21

Q.

And did you examine any logs collected from the SIPRNET

22
23

Intelink site in this case?
A.

Yes, sir, I did.

7959

11509

1

Q.

And what did those logs contain generally?

2

A.

They generally contained the source IP, the computer making

3

the request, date and time of the request and some of the search

4

list.
Q.

5
6

Now, were the Intelink logs you examined all of Intelink or

was it just associated with a particular IP?

7

A.

Sure, they were just associated with .22 and .40.

8

Q.

And what time period roughly did those -- the logs cover?

9

A.

November 2009 to May 2010.

10

Q.

And why was that time period collected as part of this

12

A.

Sir, that's when PFC Manning was in theater.

13

Q.

When you received the log files, what do you do; do you

11

14
15
16
17
18

case?

work off that copy or do you work off another copy?
A.

Sir, for ease of review I generally -- for this case I took

them and converted them to an Excel spreadsheet for ease of review.
Q.

Okay.

So let's just back up a little bit though.

In what

form did you receive the log files?

19

A.

They were text files.

20

Q.

And what is a text file?

21

A.

Sir, it's just, just raw text, unformatted.

22

Q.

And so what did you do once you found or at least opened

23

the files and they were text files, what did you do next?

7960

11510

1

A.

I imported them into Excel.

2

Q.

And generally why do log files come to you in text, is that

3

standard?

4

A.

Yes, sir, generally.

5

Q.

And why is that?

6

A.

Sir, it’s just for ease of transferring information between

7

one -- for review and ease of transferring the data from one computer

8

to another.

9

Q.

Text is a common format for that.

Okay.

And when you received the log files in text, if you

10

had printed those text files -- first let me ask this question.

11

it one big file or several small file files?

Was

12

A.

There are several smaller files.

13

Q.

If you had printed just one of those files, approximately

14

how many pages would that have come out to?

15

A.

Quite a lot.

Maybe a hundred or so, if not more.

16

Q.

And that's just for one log file?

17

A.

I believe -- Yes, sir.

18

Q.

Now, you said you converted these text files into Excel?

19

A.

Yes, sir.

20

Q.

And once they were converted, if you had printed that

21

entire log sheet essentially or all the logs for the time period, how

22

many pages are we talking about?

23

A.

A lot.

Several hundred, if not more.

7961

11511

Q.

1
2

And in your line of work, do you regularly transfer text

files from just their native format to Excel?

3

A.

Yes, sir.

4

Q.

And is that a difficult process?

5

A.

No, sir.

6

Q.

And when you transfer the information from text to the

7

Excel spreadsheet, did you alter the information in any way?

8

A.

No, sir.

9

Q.

All right.

10

Excel format.

11

next?

12

A.

So let's talk about the logs in their -- in the

Once you had them in that format, what did you do

I wanted to determine since this is Google basically, I

13

wanted to determine what keywords were used, what was, what keywords

14

were entered and what was searched.

15
16
17

Q.

And how do you determine based on looking at the logs what

searches were made from these computers?
A.

What I did is I went to Intelink on my SIPRNET computer and

18

I did some keyword searches and then I requested my Intelink logs

19

from my SIPRNET computer.

20
21

Q.

Now, when you say you requested your Intelink logs, did you

have to go somewhere else to ask for ----

22

A.

I had to put a request in.

23

MJ:

Just a moment.

Yes.

7962

Yes, sir.

11512

1

ADC[CPT TOOMAN]:

Your Honor, if the government would like to

2

introduce the logs that Agent Shaver made, the defense will stipulate

3

to that.

4

MJ:

5

ATC[CPT MORROW]:

6

You are laying a foundation?
I need to explain to the court essentially

what they are.

7

MJ:

8

Q. So, again, start the process of finding a search.

9
10

That's fine. Go ahead.
How would

you find a search?
A. Yes, sir.

So I found the keywords that I searched for and

11

then I went to the logs and determined there was a specific pattern

12

that predates before the search, so once I figured out what the

13

pattern is, the keyword followed it and I filtered it off of that.

14
15

Q.

So you used the pattern to then filter off the logs that

you had already collected?

16

A.

Correct.

17

Q.

And once you had that pattern identified in the raw logs

18
19

essentially, what did you do next?
A.

I extracted all the keywords out as a separate tab on the

20

Excel spreadsheet and then I started looking at what keywords were

21

entered.

22
23

ATC[CPT MORROW]:

I am retrieving Prosecution Exhibit 81 for

Identification from the court reporter.

7963

11513

1

Q.

2

please.

3

A.

4

ATC[CPT MORROW]:

5

Yes, sir.
Your Honor, this exhibit already been shown

to defense counsel.
MJ:

6
7

Agent Shaver, if I could have you move to the panel box,

All right.

Thank you.

I notice Captain Tooman nodding his

head.

8

ADC[CPT TOOMAN]:

Yes, ma'am.

9

ATC[CPT MORROW]:

I am handing the witness what has been

10
11
12

marked as Prosecution Exhibit 81 for Identification.
Q.

Agent Shaver, if you could just take a moment and look at

you that, please.

Agent Shaver, do you recognize that document?

13

A.

Yes, sir, I do.

14

Q.

And what is it?

15

A.

Sir, this is the keywords, the spreadsheet that I created

16
17
18
19

that contains the keywords.
Q.

When you say keywords, again, what does that mean for --

What kind of activity is that capturing from the Intelink logs?
A.

Sir, if you went to the Intelink, it's a website, if you

20

went there and you would put a keyword in, cat, dog, it would log

21

that, the word cat, and that's what I did was I pulled out those

22

individual searches.

23

put in a keyword and hit enter.

So you, again, this is -- go to the website,

7964

11514

1

Q.

And, Agent Shaver, did you create that document?

2

A.

Yes, sir.

3

Q.

And, again, is that an accurate summary of all of the

4

Intelink searches on the SIPRNET from these two user accounts?

5

A.

Yes, sir.

6

Q.

The two computers, .22 and .40?

7

A.

Yes, sir.

8

Q.

And when you extracted the searches from the full logs, did

9

The two computers, sir.

you alter the information in any way?

10

A.

I extracted out the information, but I did not alter.

11

ATC[CPT MORROW]:

Your Honor, at this time the prosecution

12

moves to admit Prosecution Exhibit 81 for Identification into

13

evidence.

14

ADC[CPT TOOMAN]:

15

MJ:

16
17
18
19

No objection, Your Honor.

May I see it, please?

Prosecution Exhibit 81 for

Identification is admitted.
ATC[CPT MORROW]:

I'm going to hand the exhibit back to the

witness to ask a few questions.
Q.

Agent Shaver, can you generally just describe the

20

information and the columns just, you know, the headers essentially

21

left to right.

22
23

A.

Sure. Yes, sir.

The first field would be a number field,

that's something I put in there to make it easier so you can

7965

11515

1

reference the numbers.

2

The next field is the date and time.

3

zone.

4

Number 2 -- The next field is IP address.
The next field is the time

And the action, the keyword that was entered.
Q.

Now, when you say date, I'm sorry, when you say date and

5

time, what do you mean by that, the date and time something was

6

searched?

7

A.

Yes.

8

Q.

And when was the first search by either one of those

9

computers?

10

A.

It would be 10 November 2009.

11

Q.

And when was the last search?

12

A.

7 May 2010.

13

Q.

And I want to talk about -- actually, first, let me just

14

ask this question.

15

-- in that summary?

When was the first search for WikiLeaks in those

16

A.

1 December 2009.

17

Q.

And are there any other searches based on your review of

18

those searches that you thought were of interest to the investigation

19

or odd in any way?

20
21
22

A.

Yes, sir.

There were several that were odd, searches for

things like Iceland and Julian Assange, they seemed out of place.
Q.

And why do you say that?

7966

11516

1

A.

Sir, it is my understanding these computers were at FOB

2

Hammer Iraq and should have been focused on events in and around FOB

3

Hammer Iraq.

4

ATC[CPT MORROW]:

5

Exhibit 81.

6

Thank you.

7

Q.

Thank you.

I'm retrieving Prosecution

Agent Shaver, you can move back to the witness box.

Agent Shaver, I want to talk about some of the searches for

8

WikiLeaks and where they led on the SIPRNET.

9

user at one of the IP addresses searches for WikiLeaks, what comes

10
11

What happens when the

back in the log?
A.

There would be some search hits.

If the user then clicks

12

on log files or clicks on a link, it will show that link has been

13

clicked and things of that nature.

14
15

Q.

Now, in this case at least for these SIPRNET Intelink logs,

does the activity after the search, is that always captured?

16

A.

No, sir.

17

Q.

And why would sometimes there be gaps, sir?

18

A.

If the user went to a web page, entered Intelink, entered a

19

search term and it was directed to a new web page, in essence they're

20

now on that web server, no longer part of the Intelink world.

21
22
23

Q.

Okay.

I'm retrieving what's been marked as Prosecution

Exhibit 45 for Identification.
MJ:

Captain Tooman?

7967

11517

1
2
3

ADC[CPT TOOMAN]:

I'm just standing up to look at it, Your

Honor.
ATC[CPT MORROW]:

I'm handing the witness what has been marked

4

as Prosecution Exhibit 45 for Identification.

5

take a look at that, please.

Agent Shaver, just

6

Q.

Do you recognize that document?

7

A.

Yes, sir, I do.

8

Q.

And what is it?

9

A.

It's the Army Counter Intelligence Center report on

10

WikiLeaks.

11

Q.

And was this document accessible via the SIPRNET?

12

A.

Yes, sir.

13

Q.

And based on your review of the Intelink logs, did any

14

searches for WikiLeaks lead to the discovery or the access of this

15

document on the SIPRNET?

16

A.

Yes, sir.

17

Q.

And how did you go about identifying this particular

18
19

document in the Intelink logs?
A.

This document was provided to me for examination to compare

20

against a document which was released by WikiLeaks, and the original

21

document that was provided to me a unique name was provided.

22
23

Q.

So it wasn't titled at least whatever the title of the

document was?

7968

11518

1

A.

No, sir.

2

Q.

Do you recall at least what the title was?

3

A.

It started with RBO8 and there were some numbers after

4
5

that.
ATC[CPT MORROW]:

Okay.

I am retrieving Prosecution Exhibit

6

45 for ID from the witness and I am retrieving, again, Prosecution

7

Exhibit 84 for Identification from the court reporter.

8

the witness what has been marked as Prosecution Exhibit 84 for

9

Identification to the witness.

I am handing

10

Q.

Agent Shaver, do you recognize that document?

11

A.

Yes, sir, I do.

12

Q.

And what is it?

13

A.

This is another document I created based upon the searches

14

for that RB document from the Intelink logs.

15

Q.

So what does that document show essentially?

16

A.

It shows four different times in which the IP .40 viewed or

17
18
19
20

attempted to view the RB document.
ATC[CPT MORROW]:

Okay.

I'm retrieving -- Permission to

publish to the court, Your Honor?
MJ:

Proceed.

21

[There was a brief pause while the assistant trial counsel published

22

Prosecution Exhibit 84 to the Court.]

7969

11519

1

Q.

Agent Shaver, I want to start with line 1.

Can you just

2

describe for the Court the activity, the action on the very far

3

right, please?

4

A.

Yes, sir.

5

Q.

Don't worry about that.

6

A.

Okay.

7

Q.

You can just describe the box there.

8

A.

Okay.

9

you, sir.

You see the last -- how do you clear it?

The line I've managed to -- there you go.

Thank

The last line there you see it says

10

HTTP/WWW.Intelink.S.gov/search/default, and it’s Q=WikiLeaks, that’s

11

a -- that was the search query for this, the search terms WikiLeaks

12

was used, and these are the -- the result was this document.

13

again, if you look at that third from the bottom it says the address,

14

AKIKA.north-INSCOM.Army.smil.mil, a little further down you see the

15

document itself, RB08-617.ASP, and a little further to the right you

16

see where it says 200 and then there's numbers at the end.

17

means it's successful, this document was viewed.

18

Q.

Okay.

19

A.

That's like a web page.

20

Q.

Okay.

21

And if,

The 200

And what's a .ASP?

In lines 2, 3, and 4 do you see the -- is there also

a successful access in those cases?

7970

11520

1

A.

No, sir.

The 302 it's a redirect, so at this time if they

2

clicked on that link looking for that specific document, it went

3

somewhere else.

4
5

Q.

Okay. So you can't tell if that was successful access of

that document?

6

A.

No, sir.

7

Q.

Now, again, in at least this summary, what, which line is

8

the successful access versus the unsuccessful?

9

A.

It would be the first one, sir.

10

Q.

And what's the date of that search?

11

A.

29 December 2009.

12

Q.

Thank you.

13

MJ:

My understanding the 29 December 2009, was successful and

14
15

the other three were not?
WIT: They may have been, therein lies the permutation of the log

16

files.

It meant if you click on the link, it may have -- it

17

redirected it to somewhere else and I don't know where.

18

MJ:

Thank you.

19

WIT: So it may have been.

20

ATC[CPT MORROW]:

Your Honor, at this time the prosecution

21

moves to admit Prosecution Exhibit 84 for Identification into

22

evidence.

23

ADC[CPT TOOMAN]:

No objection, Your Honor.

7971

11521

1

MJ:

All right.

Prosecution Exhibit 84 is admitted.

2

Q.

Agent Shaver, I want to talk about the Intelink searches in

3

the 14 February 2010 timeframe.

First, based on your review of the

4

searches in these logs, did the logs capture any searches for

5

WikiLeaks on 14 February 2010?

6

A.

Yes, sir, I believe they did.

7

Q.

And generally again where did these searches lead on the

8
9
10
11
12
13

SIPRNET?
A.

To websites that have information pertaining to WikiLeaks.

ATC[CPT MORROW]:

I'm retrieving what's been marked as

Prosecution Exhibit 85 for Identification.
Q.

Agent Shaver, I'm handing you Prosecution Exhibit 85 for

Identification.

14

A.

Yes, sir.

15

Q.

Just take a moment and look at it, please.

16

ATC[CPT MORROW]:

I'm retrieving Prosecution Exhibit 85 for

17

Identification with the witness.

18

Your Honor.

19

May I have permission to publish,

MJ: Go ahead.

20

[There was a brief pause while the assistant trial counsel published

21

Prosecution Exhibit 85 for Identification to the Court.]

7972

11522

1

Q.

Agent Shaver, I won't go through all the lines in this

2

document, but could you just describe for the Court what this, first

3

of all, again, what is the document?

4
5

A.

14th, 2010.

6

Q.

7

action?

8

A.

9
10

Again, this is a subset of the Intelink logs for February

And where does this subset of logs begin, what's the first

Again, it's another search for WikiLeaks, you can see that

from the top line under the Q=WikiLeaks, and this search ended up on
an Army website.

11

Q.

Can you just point out the line, please?

12

ATC[CPT MORROW]:

It might be easier if I just hand it back to

13

the witness.

14

A.

Yes.

15

Q.

Were you able to -- Based on your review of the logs, were

I'm sorry, it's a little blurry on here.

16

you able to identify any documents accessed by the user of those IP

17

addresses in the logs?

18

A.

Yes, sir.

19

Q.

And what documents were you able to identify as being

20

accessed?

21

A.

There is one called CCCHereBeDragonsTripReport.

22

Q.

And what line is that in that summary?

23

A.

12.

7973

11523

1
2
3
4
5

Q.

And were there any other documents accessed as a result of

this search on Intelink?
A.

There is an IIR as well, following a bunch of numbers,

classified documents on WikiLeaks .PDF.
Q.

And based on your review of the Interlink logs generally,

6

have you ever seen this document accessed at a previous time other

7

than February 14th?

8

A.

Yes, sir.

9

Q.

And what timeframe was that?

10

A.

I believe it was early December.

11

Q.

Agent Shaver, I just want to -- who created this document?

12

A.

I did.

13

Q.

And how did you create it?

14

A.

Sir, it was just filtered on the date for February 14th.

15

ATC[CPT MORROW]:

Your Honor, at this time the prosecution

16

moves to admit Prosecution Exhibit 85 for Identification into

17

evidence.

18

ADC[CPT TOOMAN]:

No objection.

19

MJ:

20

Q. Agent Shaver, I want to shift gears for a moment.

May I see it, please?
Other than

21

searches made from the computers on Intelink, what other activity was

22

significant that you observed in the Intelink logs?

7974

11524

1
2

A.

There were a number of hits -- there were a number of

downloads using the WGet utility.

3

Q.

And what is WGet?

4

A.

Sir, that is a command line program executable designed to

5
6
7
8
9

basically download files from web pages.
Q.

And when you say something's a command line program, what

do you mean by that?
A.

It's command line, so there is not a graphical user

interface.

There's no need for a mouse.

You have to type the

10

commands in from the command prompt.

So if you were to go to, you

11

have a Windows computer, if you go to start, run, type CMD, and hit

12

enter, that will be a DOS, a little black window would open and that

13

would be command window.

You could then type commands from there.

14

Q.

Now, is WGet -- what is it, is it software?

15

A.

Yes, sir.

16

Q.

And you also said something about executable.

17

What's an

executable?

18

A.

It's just a program that runs.

19

Q.

And what's the difference between software and executable?

20

A.

Same thing, sir.

21

Q.

It's just exactly basically?

22

A.

Yeah.

7975

11525

Q.

1
2

Now, based on your knowledge and experience, is WGet a

standard program on Army computers?

3

A.

Not Windows computers, no, sir.

4

Q.

Why do you say that?

5

A.

Sir, part of our mission at CCIU was to find malware on a

6

computer, so we had access to the Army Gold Master.

And the Army

7

Gold Master or AGM is how the Army distributes software to include

8

Office and operating systems themselves across the Army network.

9

we had access to that.

So

We would use that to, once you know what's

10

supposed to be there, it's easier to figure out what's not supposed

11

to be there.

12

Q.

13

logs.

All right.

Let's talk about the presence of WGet in the

Do you recall the first example of WGet in the logs?

14

A.

I believe it was March 2010.

15

ATC[CPT MORROW]:

I am retrieving what's been marked as

16

Prosecution Exhibit 83 for Identification.

17

defense counsel.

18

Prosecution Exhibit 83 for Identification.

19
20

Q.

I'm now showing them to

I'm handing the witness what has been marked as

Agent Shaver, could you take a moment and look through

that, please?

21

A.

Yes, sir.

22

Q.

Do you recognize that document?

23

A.

Yes, sir, I do.

7976

11526

1

Q.

And what is it?

2

A.

Sir, this is, again, this is a filtered on WGet from March

3

7th from the Intelink logs.
Q.

4
5

And, again, when you say you filtered, so you created that

document?

6

A.

Yes, sir, I did.

7

Q.

And when you created the document, did you alter the

8

information in any way from the original logs?

9

A.

No, sir.

10

Q.

So what was the filter you used to sort of create that

11

summary?

12

A.

Basically WGet and on March 7th.

13

Q.

And what does that document show, just generally, and I’ll

14

-- in a moment we'll go through it, but just generally what does it

15

show?

16
17
18
19

A.

Sir, it shows a large number of files being downloaded in

an automated fashion.
Q.

And when is the date of the first download of a document

using WGet?

20

A.

That would be March 7th, 2010.

21

Q.

What time?

22

A.

3:18.

7977

11527

Q.

1
2

And when is the last action of downloading using

WGet in

the logs?

3

A.

Last action is March 7th, 2154.

4

Q.

2154?

5

A.

I'm sorry.

6

Q.

So approximately between the first and last action, how

7

Your -- I’m sorry.

7:06, I apologize.

much time elapsed?

8

A.

Just a few hours.

9

MJ:

Wait a minute.

Let me stop you there.

So the first

10

download is 7 March at 3:18 and the second one is 7 March at when, or

11

the last one?

12

WIT: The last one, I apologize, ma'am, 7:06.

13

MJ:

Using military time or using civilian time?

14

Q.

This might be easier -- Agent Shaver, let's just go through

16

A.

No problem.

17

ATC[CPT MORROW]:

15

18
19

it.

Permission to publish to the Court, Your

Honor.
WIT: Ma’am, military time.

20

[There was a brief pause while the assistant trial counsel published

21

Prosecution Exhibit 85 for Identification to the Court.]

22
23

ATC[CPT MORROW]:

I'm just going to show the first page of

this exhibit, Your Honor.

7978

11528

1
2
3

Q.

Agent Shaver, approximately how much time, based on your

review of these logs, how much time elapses between each use of WGet?
A.

Not a lot, sir.

4

they're all 7:46.

5

each one.

6

Q.

If you can see from lines 7 through 13,

Or excuse me 3:46.

So not a lot of time between

And let's, if you could just look at those lines

7

specifically and just move to the right there, can you describe the

8

action at the very right of the screen?

9

then describe going right, what does that mean?

10

A.

Yes, sir.

Starting at 200.

11

following it is the size of the file.

12

right it shows what was used.

13

the version, 1.11.4.

14

Q.

What does the 200 mean and

200 means success.

The number

And a little further to the

In this case it was WGet and that was

Now, if you go to the left a little bit, I see a number of

15

lines sort of recreated, document ID equals 144708, and then a number

16

of document IDs.

17

A.

What is the document ID?

The document ID -- The server this is being captured from

18

is a Sharepoint server pertaining to Guantanamo Bay detainees.

As

19

such the documents are not stored by a common name, they're stored by

20

a document ID.

21

you would click on the link that said, a file common name, maybe a

22

person’s last name.

23

say to retrieve a certain document ID.

So to retrieve it, if you were to go to the website,

But actually underneath it in the code it would

7979

11529

1

Q.

So in this case what does the document ID represent?

2

A.

A file name.

3

Q.

Agent Shaver, approximately how many WGet actions did you

4

observe in this log on 7 March?

5

A.

Over 700.

6

ATC[CPT MORROW]:

Your Honor, at this time the prosecution

7

moves to admit Prosecution Exhibit 83 for Identification into

8

evidence as Prosecution Exhibit 83.

9
10
11
12

ADC[CPT TOOMAN]:
MJ:

No objection, Your Honor.

May I see it, please?

Thank you.

Prosecution Exhibit 83

for Identification is admitted.
Q.

Agent Shaver, you said that those document IDs resolved or

13

went back to the detainee assessments located on the SIPRNET.

14

that correct?

Is

15

A.

Correct.

16

Q.

Now, in any time in your review of the Intelink logs, did

17

you notice any other activity or accessing of information on detainee

18

records on Intelink?

19

A.

Yes, sir.

20

Q.

And what time was that?

21

A.

5 March 2010.

22

ATC[CPT MORROW]:

23

I'm retrieving what's been marked as

Prosecution Exhibit 82 for Identification.

7980

I’m showing it to the

11530

1

defense counsel.

I'm handing the witness what's been marked as

2

Prosecution Exhibit 82 for Identification.

3

Q.

Do you recognize that document, Agent Shaver?

4

A.

Yes, sir, I do.

5

Q.

And what is that?

6

A.

Sir, this is a document, a subset of the Intelink for March

7

5th, yeah, March 5th 2010.

8

ATC[CPT MORROW]:

9
10

Permission to publish to the Court, Your

Honor.
MJ:

Proceed.

11

[There was a brief pause while the assistant trial counsel published

12

Prosecution Exhibit 82 for Identification to the Court.]

13

Q.

14

the exhibit.

15

just describe the activity that you're seeing in the logs.

16

A.

Agent Shaver, I'm just going to show you the first page of
And if you would, Agent Shaver, using this document,

The activity, is somebody is on a computer assigned the IP

17

.22 is downloading files.

18

you see their link to the website is there and you see some 200s and

19

you see some 000s.

20

work right.

21

downloads.

22
23

Q.

Again, you see the document ID again and

There's an issue for that download didn't quite

And there's the time and dates associated with those

Now, in terms of what the user is doing or what you're

observing in this activity on the Intelink versus the 7 March

7981

11531

1

activity, what's the difference between those two accessing -- the

2

accessing of the detainee assessment on those two dates?

3

A.

This appears to be a lot of right clicking, save as.

4

Q.

And why do you say that?

5

A.

Because it's the time.

It's not as fast and there's some

6

errors, so it looks, it appears to be somebody's manually downloading

7

these files.

8

Q.

Now, did you observe WGet on 5 March?

9

A.

I do not -- No, sir.

10

Q.

And how do you know that, again, these are detainee

11

assessments, where in the logs does it show that those are the files

12

being accessed?

13
14

A.

It actually says it, right there; action line, this is the

website, wiki/JTF-GTMO_Detainee_Asessments.

15

Q.

Thank you.

Now, again ----

16

MJ:

Before you move that ----

17

ATC[CPT MORROW]:

18

MJ:

I’m sorry.

I did have a question.

You have the 200s where you say

19

were a success, after some of the 200s then you have the 000, what

20

does that mean?

21

WIT: There's a problem.

22

MJ:

Thank you.

7982

11532

1
2

Q. Agent Shaver, how was this, again, and you may have answered
this, how was this summary created?

3

A.

I filtered based off the date and the action.

4

ATC[CPT MORROW]:

Your Honor, at this time the prosecution

5

moves to admit Prosecution Exhibit 82 for Identification into

6

evidence.

7

ADC[CPT TOOMAN]:

8

MJ:

9

ATC[CPT MORROW]:

10

No objection, Your Honor.

Prosecution Exhibit 82 is admitted.
Thank you, Agent Shaver.

Government has no

further questions at this time.

11

ADC[CPT TOOMAN]:

12

minute comfort break.

13

MJ:

14

TC[MAJ FEIN]:

15

MJ:

Your Honor, the defense would request a 10-

Any objection?

All right.

No, ma'am.
Agent Shaver, please don't discuss your

16

testimony or knowledge of the case with anyone while we are on the

17

recess.

18

[The court-martial recessed at 1052, 10 June 2013.]

19

[The court-martial was called to order at 1104, 2013.]

20

MJ:

Court is in recess until 5 minutes to 11.

Court is called to order.

Let the record reflect all

21

parties present when the Court last recessed are again present in

22

court.

23

Captain Tooman, cross-examination?

7983

11533

1

ADC[CPT TOOMAN]:

CROSS-EXAMINATION

2
3

Thank you, Your Honor.

Questions by the assistant defense counsel [CPT TOOMAN]:

4

Q.

Good morning, Agent Shaver.

5

A.

Good morning, sir.

6

Q.

Agent Shaver, I'd like to start out by on direct you talked

7

a little bit about some of the computers that you had associated with

8

my client.

9

A.

Yes, sir.

10

Q.

You had associated the .22 machine?

11

A.

Yes, sir.

12

Q.

That was one.

13

A.

Yes, sir.

14

Q.

Okay.

15

moment.

16

would associate with my client before 2 March in the allocated space.

17

Is that correct?

And the other was the .40 machine?

I want to focus on the .22 machine for just a

Now, on that machine, you didn't have any activity that you

18

A.

Okay.

19

MJ:

Whoa, whoa, whoa.

20

Q.

Okay.

21
22

On the .22 machine there was a user account,

Bradley.Manning, correct?
A.

Correct.

7984

11534

1
2

Q.

And that user account didn't have anything in the

unallocated space before 2 March.

Is that correct?

3

ATC[CPT MORROW]:

Objection.

4

MJ:

5

ATC[CPT MORROW]:

6

MJ:

7

WIT: Sir, your terminology I believe is incorrect.

8

Q.

Okay.

9

A.

You're asking -- may I ask?

Yes.
Outside the scope of direct.

Overruled.

You're asking me are there any

10

files pertaining to the Bradley.Manning user account prior to 2

11

March?

12

Q.

2 March.

13

A.

That are allocated.

14

Q.

That are unallocated.

15

A.

There are ----

16

Q.

Let me rephrase the question.

17

In the .22 computer, there's

a user account, Bradley.Manning?

18

A.

Correct.

19

Q.

That user account didn't exist before 2 March, correct?

20

A.

Correct.

21

Q.

And that user account didn't exist before 2 March because

22
23

that computer had been re-imaged?
A.

Correct.

7985

11535

1
2

Q.

And that computer was re-imaged by the G6 or whoever was in

charge of those computers?

3

A.

That is correct.

4

Q.

Okay.

5

A.

Yes, sir.

6

Q.

Okay.

7

And you've been to Iraq?

And you understand that there are a lot of reasons

why a computer would be re-imaged in Iraq?

8

A.

Correct.

9

Q.

It's a difficult environment for the machine?

10

A.

Yes, sir.

11

Q.

It's hot, that puts stress on the machine?

12

It's dusty,

sandy?

13

A.

Yes, sir.

14

Q.

And those things could cause problems for the machine?

15

A.

Correct.

16

Q.

And one way that an administrator might deal with those

17

problems is to re-image it?

18

A.

Correct.

19

Q.

Okay.

20

A.

It appears to be.

21

Q.

Okay.

22
23

That's what happened with the .22 machine, correct?

And that wasn't anything my client did, that was

whoever was in charge of those machines?
A.

Yes, sir.

7986

11536

1

Q.

Okay.

Now, you talked about -- on direct you talked about

2

the Intelink logs and the searches, and you talked about how you

3

created the Excel document where you were able to pull out all of the

4

actual searches?

5

A.

Yes, sir.

6

Q.

And to separate the wheat from the chaff, here are the

7

searches, correct?

8

A.

Uh-huh.

9

Q.

And you talked about a number of searches for WikiLeaks?

10

A.

Yes, sir.

11

Q.

You talked about searches for ACIC documents?

12

A.

Just WikiLeaks.

13

Q.

Okay.

14

Well, you talked about searches or activity on the

Intelink logs related to detainee assessments?

15

A.

Correct.

16

Q.

There were in total from May -- I'm sorry. From November of

17

2006 to May of ‘10 there were probably close to 800 searches?

18

A.

Sounds right.

19

Q.

And not all of those had to do with WikiLeaks?

20

A.

Correct.

21

Q.

A lot of those searches had to do with a lot of other

22

things?

23

A.

Yes, sir.

7987

11537

Q.

1

And with those Intelink logs, all you can really say is

2

that the .22 machine or the .40 machine did a search for whatever

3

term?

4

A.

Correct.

5

Q.

You can't say that that was PFC Manning who did the search?

6

A.

Correct.

7

Q.

You can't say it was Captain Tooman who did the search?

8

A.

Correct.

9

Q.

You could say if it was you that did the search, but you

10

don't know who did the search?

11

A.

Correct.

12

Q.

Okay. There were a lot of other searches done?

13

A.

Yes, sir.

14

Q.

There were searches for gender identity disorder?

15

A.

Yes, sir.

16

Q.

There were searches for APFT scores?

17

A.

Yes, sir.

18

Q.

There were searches for Green to Gold?

19

A.

Yes, sir.

20

Q.

Now, I want to focus on some more of those searches.

21

There

were also a number of searches related to CENTCOM, correct?

22

A.

Correct.

23

Q.

Now, CENTCOM is the command that oversees Iraq, correct?

7988

11538

A.

1

Q.

2
3

Yes, sir.
Iraq falls underneath CENTCOM.

So there would be a lot of

reasons why a computer user might search for CENTCOM?

4

A.

Sure.

5

Q.

I want to talk about some of those CENTCOM searches a

6

little more specifically.

There was a search for CENTCOM on or

7

involving CENTCOM on 30 November 2009.

Is that correct?

8

A.

Sounds right.

9

Q.

There was another search on 9 December for CENTCOM that was

10

done by the 40 machine?

11

A.

Okay.

12

Q.

Is that -- do you have your ----

13

A.

I don't have the notes in front of me, sir.

14

Q.

Okay.

15

A.

That’s ----

16

MJ:

Let me ask you to do something, please.

If you know

17

something to be a fact and you're agreeing with the questioner, say

18

that.

19

something in front of you, don't agree.

If you don't know or you're not sure because you don't have

20

WIT: Okay.

21

Q. Is there anything that would allow you to answer those

22
23

questions?
A.

Yes, sir.

One of the exhibits from earlier.

7989

11539

1

ADC[CPT TOOMAN]:

Okay.

Your Honor, I'd like to retrieve

2

Prosecution Exhibit 81 and ask Mr. Shaver -- Agent Shaver to move to

3

the witness stand because I believe that's classified.

4

MJ:

5

ADC[CPT TOOMAN]:

6
7

All right.

Certainly.
Handing the witness what's been marked as

Prosecution Exhibit 81.
Q.

Agent Shaver, we'll start over.

We'll start from the top

8

with searches that implicate CENTCOM.

9

have a search by the .40 machine related to CENTCOM.

10

On the 30th of November we

correct?

11

A.

Do you have a time?

12

Q.

No, I do not.

13

A.

I’m sorry for the delay, Your Honor.

14

MJ:

Take your time.

15

WIT: Yes, sir.

16

Q.

17

Is that

There's also a search on 9 December by the .40 machine and

that's a search for SJA plus CENTCOM?

18

A.

Yes, sir.

19

Q.

Now on the 15th of November -- I'm sorry -- the 15th of

20

December, again, the .40 machine, we have a search just for CENTCOM?

21

MJ:

Did you say the 14th of December?

22

ADC[CPT TOOMAN]:

23

WIT: Correct.

15th, Your Honor.

Yes, sir.

7990

11540

1
2

Q.

The very next day, again, the .40 machine searched for

CENTCOM plus SJA?

3

A.

Yes, sir.

4

Q.

Then on the 31st of December the .40 machine searched for

5

CENTCOM plus portal?

6

A.

Correct.

7

Q.

2 January 2010, we see the 40 machine searching for CENTCOM

8

plus non-rel, N-O-N-R-E-L?

9

A.

Yes, sir.

10

Q.

On the 4th the .40 machine searches for CENTCOM?

11

A.

Yes, sir.

12

Q.

Okay.

13

Then our next search is the 19th of February, still

the .40 machine and it's just for CENTCOM?

14

A.

What date again was that, sir?

15

Q.

19 February.

16

A.

Yes, sir.

17

Q.

And then on the 28th?

18

A.

Yes, sir.

19

Q.

We have one by the .40 machine ----

20

A.

Yes, sir.

21

Q.

---- as well?

22

A.

On 28 February, yes, sir.

And that's a search for CENTCOM?

7991

11541

1

Q.

Then on 12 March, we see our first search from the .22

2

machine, and that's for a long string, but you would agree with me

3

that that is basically searching for Don't Ask, Don't Tell?

4

A.

Yes, sir.

5

Q.

Then on the 17th of March, the 22 machine searches for,

6

again, another long string E-Books plus site, %3?

7

A.

Yes, sir, I see that one, sir.

8

Q.

Okay.

9

And then on the 22nd of March we see a search for

Farah+CENTCOM, and that was the 22 machine?

10

A.

Yes, sir.

11

ADC[CPT TOOMAN]:

12

exhibit from you.

13

reporter.

14
15

Q.

Agent Shaver I’m going to retrieve that

Handing Prosecution Exhibit 81 back to the court

Now, Agent Shaver, those were the only searches for CENTCOM

on the Intelink logs that specifically talked about CENTCOM, correct?

16

A.

It looks that way, yes, sir.

17

Q.

And there was only one that specifically searched for

18

Farah?

19

A.

Correct.

20

Q.

And that was on 22 March?

21

A.

Yes.

22

Q.

Agent Shaver, I want to talk a little bit more about Farah.

23

You talked on direct about there are ways that we can tell, you can

7992

11542

1

tell a search was done, but we can't really tell what happened after

2

that.

Is that correct?

3

A.

That is correct.

4

Q.

There's some indication that maybe a file was viewed, but

5

we have to look other places to find out what happened as a result of

6

that search, correct?

7

A.

Correct.

8

Q.

And one of those places would be Centaur logs.

9

Is that

correct?

10

A.

Yes.

11

Q.

Could you explain for the Court what a Centaur log is?

12

A.

Yes, sir.

13

ATC[CPT MORROW]:

14

MJ:

15

ATC[CPT MORROW]:

Your Honor, objection.

Yes.
There's been no evidence to suggest that he

16

examined something called a Centaur log.

17

It's outside the scope of direct examination.

18

MJ:

19

ADC[CPT TOOMAN]:

Lack of foundation here.

How is it within the scope of direct examination?
It's within the scope of direct examination,

20

Your Honor, because the government talked about searches and then

21

different ways that we can see what happened with the searches.

22

Additionally, the government has already requested judicial notice of

23

the Centaur logs so that's already something the Court has

7993

11543

1

considered.

2

about that.

3

MJ:

This witness has reviewed the Centaur logs, he will talk

I'm going to overrule at this point.

4

what a Centaur log is.

5

what it is?

6
7
8
9
10
11
12
13

No, Your Honor.

I do dispute the fact that

we asked you to take judicial notice of the Centaur logs though.
MJ:

Do you have your consolidated judicial notice list has that

been put on as an appellate exhibit yet?
ADC[CPT TOOMAN]:

Your Honor, it's in the 18 July 2012 ruling,

Appellate Exhibit 216.
MJ:

May I see Appellate Exhibit 216, please?

216 is the one

you're relying on, right?
ADC[CPT TOOMAN]:

15

MJ:

17

Do you dispute the fact that he does know

ATC[CPT MORROW]:

14

16

He’s just telling me

All right.

Thank you.

Appellate Exhibit 216.
TC[MAJ FEIN]:

Yes, ma'am.
Government, I'm looking at

Number 4 talks about Centaur logs.

Yes, ma'am.

So this was a government motion to

18

preadmit evidence, not judicial notice.

The government did move to

19

preadmit and the Court ruled that based off the government's showing

20

of relevance that this evidence would otherwise be admissible.

21

government does intend to admit this evidence, in fact, with the

22

predicate witnesses prior to Special Agent Shaver and then Special

23

Agent Shaver's testimony.

The

I think my co-counsel's objection was just

7994

11544

1

based off it's outside the scope of this direct because there's no

2

context, no foundation, prior facts not going to understand that the

3

background is Centaur.
MJ:

4
5

So you're going to be recalling this witness to talk about

Centaur logs at some point?

6

TC[MAJ FEIN]:

7

MJ:

8

ADC[CPT TOOMAN]:

9
10

Absolutely, Your Honor.

Why are we getting into it now?
Your Honor, the defense believes that the

government opened the door to Agent Shaver's investigation and we'd
like to talk to him about it.
MJ:

11

The government didn't mention anything about Centaur logs,

12

so are you waiving your relevance objection for these logs to come

13

in?

14

ADC[CPT TOOMAN]:

15

TC[MAJ FEIN]:

16

ADC[CPT TOOMAN]:

17

MJ:

18
19
20
21
22
23

Yes, Your Honor.

You would?
Yes, Your

Honor.

I think it's beyond the scope of direct.

The government

just didn't talk about it, so I'm going to sustain the objection.
ADC[CPT TOOMAN]:

Okay.

Questions continued by the assistant defense counsel [CPT TOOMAN]:
Q.

Okay, Agent Shaver, I'd like to talk to you, you spoke on

direct about the ACIC report?
A.

Yes, sir.

7995

11545

Q.

1
2

And you saw a number of searches for that.

One was on 29

December, there was one on 14 February?

3

A.

Correct.

4

Q.

And then there were two on 1 March, correct?

5

A.

Yes.

6

Q.

Your testimony on direct was only one of those searches was

7

successful and that only one time did something get pulled up?

8

A.

No, sir, your ----

9

Q.

Okay.

10

A.

I could show, number one, the first hit was a success.

11

other ones are redirected.

12

They're redirected to another log file, another server.

13

tell you if it was either successful or it was not.
Q.

14
15

Okay.

The

I don't know if they're successful.
I cannot

So only that first search could you say for sure

this was successful?

16

A.

Correct.

17

Q.

Now, based on your review of the intel logs, you couldn't

18

say if that document was downloaded, correct?
A.

19
20

see the bytes transferred.

21
22
23

It was viewed, so technically it was downloaded because you

Q.

Okay.

A.

No, sir.

It was viewed upon the computer itself.

You couldn't tell if there was a right click, save

as?

7996

11546

1

Q.

You couldn't tell if it was printed?

2

A.

No, sir.

3

Q.

Okay.

4

You also couldn't tell how long that screen was up,

correct?

5

A.

Correct.

6

Q.

So it could have been up for a second, it could have been

7

up for 5 minutes?

8

A.

Correct.

9

Q.

The same would be true for the C3 report that you talked

10

about on direct as well, correct?

11

A.

Correct.

12

Q.

You can't tell how long it was viewed.

13

A.

Correct.

14

Q.

You can't tell if it was saved?

15

A.

Correct.

16

Q.

You also couldn't tell if it was printed?

17

A.

That's correct.

18

Q.

And I believe you said that the 22 machine is the one that

Is that correct?

19

did those things.

Either way you can't associate the viewing of

20

those documents with any particular person, correct?

21

A.

Correct.

22

Q.

Just with the machine.

23

A.

Correct.

7997

11547

1

Q.

I'd like to speak with you, you talked about WGet on

2

direct.

3

with me that WGet is a program that's used to download web pages?

I'd like to talk to you now about that.

You would agree

4

A.

Yes, sir.

5

Q.

Kind of archive pages?

6

A.

Sure.

7

Q.

Download things?

8

A.

Sure.

9

Q.

You wouldn't say that this is a program that's synonymous

10

with hacking, would you?

11

A.

Correct.

12

Q.

Just a normal program that's used every day by a lot of

13

It's just a tool.

different people?

14

A.

Yes, sir.

15

Q.

Now, you talked about detainee assessment briefs?

16

A.

Yes, sir.

17

Q.

And you talked about the Intelink's logs show that on 5

18

March there were attempts from your perspective of clicking, opening

19

and saving, that's what the Intelink log suggested?

20

A.

Correct.

21

Q.

And then on 7 March you had, again, activity with the

22

detainee assessment briefs, but here it looked like WGet was used to

23

download those files, correct?

7998

11548

1

A.

Yes, sir.

2

Q.

You would agree with me that basically what WGet was doing

3

was clicking, opening and saving, it was just doing it quickly?

4

A.

In automated fashion.

5

Q.

Faster than a human could do it?

6

A.

Yes.

7

Q.

But still the same action, essentially the click, open,

9

A.

Correct.

10

Q.

Now, as part of your investigation, you actually used WGet,

8

11

save?

didn't you?

12

A.

Yes, sir, I did.

13

Q.

And what you did with WGet was you tried to download -- you

14
15

wanted to see if you could download the detainee assessment briefs?
A.

Correct.

16

Q.

And you were able to do that?

17

A.

Yes, sir.

18

Q.

And what you did was you wrote a script and you ran the

19

script and then you actually downloaded the detainee assessment

20

briefs?

21

A.

Yes, sir.

22

Q.

And that only took you a few minutes to do?

23

A.

Yes, sir.

It did not take very long.

7999

11549

1
2

Q.

It didn't take very long to download over 700 detainee

assessment briefs?

3

A.

Correct.

4

Q.

And while that was happening, you were able to do other

5

things on your machine?

6

A.

Yes, sir.

7

Q.

So one could run WGet and it would run in the background

8

and you could do other things?

9

A.

Yes, sir.

10

Q.

Sure.

You would take a performance hit, but, yes.

When WGet's running, you don't have to actually be

11

there, do you?

You don't have to be sitting at the computer actively

12

doing anything, correct?

13

A.

No, sir.

14

Q.

And, again, it basically just automates the click, save --

15

or click, open, save?

16

A. Correct.

17

ADC[CPT TOOMAN]:

18

MJ:

19

ATC[CPT MORROW]:

20

MJ:

21

All right.

All right.

No further questions, Your Honor.
Redirect.
No, Your Honor.
I have a couple.
[END OF PAGE]

22

8000

11550

EXAMINATION BY THE COURT-MARTIAL

1
2

Questions by the military judge:

3

Q.

We talked earlier about the 200 means it's successful?

4

A.

Uh, huh.

5

Q.

And the 000 means there's a problem?

6

A.

There’s an issue.

7

Q.

And we talked -- You just said in response to Captain

8

Tooman's questions that when a search is redirected to somewhere

9

else, you don't know what happens to it.

Can you just tell me, like

10

give me an example of a search, you would search for something and it

11

would go somewhere else and what happens?

12

A.

Yes, ma'am.

So are you familiar with Google?

13

Q.

Yes.

14

A.

So you open Google and you put in Wolf Blitzer, it takes
Google

15

you to the CNN web page and now you're on the CNN web page.

16

is no longer tracking what you're doing on CNN, but the redirect took

17

you there.

18

directed to another site, and once it's on the other site it's no

19

longer part of Intelink.

20

Q.

And in this instance that RB -- the RB document was

Yes.

Thank you.

Does that make sense?
You testified earlier that to assess

21

whether a program is authorized on an Army computer, I just want to

22

make sure I got your testimony correctly.

23

Gold Master's program to determine?

8001

What did you use the Army

11551

1

A.

We used that -- excuse me.

When I worked at CCIU, we would

2

use that to determine what are the authorized programs, those are the

3

Army programs that are commonly available to the computers, to the

4

computers on the Army network.

5

Q.

WGet was never part of those.

If you're not the right witness to ask this question to,

6

tell me.

7

not on here, you can't use it or you can't put it on the computer?

8
9
10
11

A.

Are you familiar with, does that program say that if it's

No, ma'am.

That would be considered a certificate of

networthiness, also called a CON.

That’s where -- That would be the

final authority on what's authorized and what is unauthorized.
Q.

I'm beginning to stray into areas that the government

12

mentioned on their direct, but were not fully explored.

13

objection to my continuing to question this witness about them?

14

ATC[CPT MORROW]:

No, Your Honor.

15

ADC[CPT TOOMAN]:

No, ma'am.

16

Q.

17

All right.

Any

So, tell me what that was called again, a

certificate of ----

18

A.

Networthiness.

19

Q.

Assume I'm a computer user and I want to -- how do I go

20
21

It’s commonly referred to

as a CON, C-O-N.

about obtaining a CON?
A.

It is a process through one of the Army CERTS, the Army

22

Regional Computer Emergency Response Team at Fort Huachuca, Arizona.

23

You would put in a request to use a piece of software on the Army

8002

11552

1

network.

2

certain criteria, whether you have to pay for it, what it does on the

3

network, does it create a vulnerability on the network.

4

they would eventually get back to you and say yes or no.

5

Q.

They would evaluate it to make sure it's not -- it meets

And then

The Army sometimes structures automation such that the user

6

does not have administrative rights to insert -- to add things in the

7

computers that you examined that you testified about today, could the

8

user -- did the user have administrative rights to add whatever they

9

wanted to?

10

A.

No, ma'am, they do not.

However, WGet is the -- the

11

executable itself does not need administrative privileges to run, so

12

you can use, anybody can download it, anybody can run it.

13
14
15
16

Q.

Are you aware of any specific authorization of or

prohibition of program WGet?
A.

When I looked at the certificate of networthiness, WGet was

not on that list.

17

Q.

So that certificate is one certificate of ----

18

A.

It’s the -- The CON itself is one -- the one I saw was an

19

Excel spreadsheet of what was authorized and what was not authorized

20

for the Army network.

21

obtained it for another case.

22
23

Q.

I was looking at it for another matter.

I

But WGet was not present on that CON.

And that CON was applicable for what, a particular unit or

geographic area?

8003

11553

1

A.

As far as I know, the Army.

2

MJ:

Any follow-up questions from either side based on my

3
4
5

questions?
ATC[CPT MORROW]:

8
9

Just a couple of

questions, Your Honor.
REDIRECT EXAMINATION

6
7

One moment, Your Honor.

Questions by the assistant trial counsel [CPT MORROW]:
Q.

Agent Shaver, when someone searches for something on the

SIPRNET, and we've probably have gone over this again, but what does

10

the resulting, at least if you're on the Intelink server, what does

11

the resulting activity show in the logs?

12

A.

It would show any hits pertinent to the search you put in.

13

Q.

Now, when you say hits, what do you mean by that?

14

A.

Again, it's basically Google, so if you put a keyword in,

15

again, let's go back to Wolf Blitzer, all the hits -- everything that

16

pops up would be pertinent to the key term Wolf Blitzer.

17

Q.

So you would have a number of results?

18

A.

Yes, sir.

19

Q.

And if you clicked on one of those results, what would

20

happen?

21

A.

22

Say for -- It would take you to the website or the document

pertaining to that information.

8004

11554

1

Q.

Now, if it took you to the website or document pertaining

2

to that information, would that activity always be captured by the

3

Intelink logs?

4

A.

No, sir.

5

Q.

And why is that?

6

A.

Depends, sir.

Depends where the document is located.

7

Again, if it's not on -- if it's on another website it would be

8

captured -- that information would be captured on that other website.

9
10

Q.

Agent Shaver, when you were talking about the certificate

of networthiness, what type of computer were you referring to?

11

A.

A Windows computer.

12

Q.

But SIPRNET, NIPRNET, what were you talking about?

13

A.

Either or.

14

Q.

Now have you seen the certificate of networthiness for a

15

DCGS Alpha computer?

16

A.

No, sir, I have not.

17

Q.

And where does WGet come from, where does someone acquire

18
19
20

or obtain the WGet program?
A.

You would find it on the -- you would search for it on the

Internet and find it on the Internet.

21

Q.

So it's available to anyone on the Internet?

22

A.

That's correct.

8005

11555

Q.

1

And if you were to put a program or an executable like WGet

2

on a computer, and you wanted it to be available to all the users of

3

that computer, anyone who logged in, where would you put it on the

4

computer?

5

A.

Program files.

6

Q.

And why would you put it in the program files if you wanted

7

it to be available to all the users of that computer?
A.

8
9

it.

It's a permission issue.

So everybody would have access to

They can all execute to that document.

If for example you put

10

it in a user profile, one user profile just due to permissions cannot

11

see the contents of another user for security reasons.

12
13

Q.

So a computer may have any number of user profiles because,

at least in the government, people share computers, right?

14

A.

Yes, sir.

15

ATC[CPT MORROW]:

Okay.

16

ADC[CPT TOOMAN]:

Just a couple, Your Honor.
RECROSS-EXAMINATION

17
18

Thank you.

Questions by the assistant defense counsel [CPT TOOMAN]:

19

Q.

Agent Shaver.

20

A.

Sir.

21

Q.

You spoke about the Army Gold Master's Program.

The Army

22

Gold Master Program, they don't review every program or software

23

executable file that exists, correct?

8006

11556

1
2
3

A.

The Army Gold Master is just a disk of software they

provide, the Army provides to the users.
Q.

Well, the Army doesn't review every single file or piece of

4

software type of executable file to determine whether or not there's

5

a certificate of networthiness for it, correct?

6

everything?

Did it look at

7

A.

Everything in the world or everything ----

8

Q.

Everything in the world.

9

A.

No.

10

Q.

So the fact that there isn't a certificate of networthiness

11

doesn't necessarily mean that it would be a problem to have it on the

12

Army system?

13

A.

Technically as I understand it, technically you would need

14

an exception to policy.

15

exception of policy to run a specific program on a specific network

16

for a specific reason.

17

Q.

It’s the Army.

You would just have an

There would be a signed document for that.

And I guess a certificate of networthiness or the lack of a

18

certificate of networthiness doesn't mean if the program were

19

reviewed it wouldn't get one?

20

A.

Correct.

21

Q.

Now, you talked about WGet.

22
23

correct?
A.

That's correct.

8007

WGet is an executable file,

11557

1

Q.

And you double click on it, it opens, and it runs, correct?

2

A.

You would have to -- Again, it's a command line, so if you

3

double click on it, a black window would open and close very quickly

4

and not do anything.

5
6

Q.

Okay.

You have to do it from the command line.

Well, you would agree with me that it's an

executable file?

7

A.

Yes, sir.

8

Q.

And Army systems can be configured to prevent the running

9

of executable files?

10

A.

Yes.

11

Q.

Now, you talked about where an individual can put a file if

12

they add something to their machine.

13

personal user file or it could get added to program files, correct?

14
15
16

A.
Q.

Correct.
If I wanted to add something to the program files, I would

need administrative rights for that, wouldn't I?

17

A.

18

ADC[CPT TOOMAN]:

19

MJ:

20

ATC[CPT MORROW]:

21

They could put it in their own

That's correct.
Nothing further, Your Honor.

Any redirect from the government?
No, Your Honor.
[END OF PAGE]

22

8008

Thank you.

11558

EXAMINATION BY THE COURT-MARTIAL

1
2
3

Questions by the military judge:
Q.

Let me just make sure I'm clear on this.

Based on the last

4

question from Captain Tooman, am I understanding this WGet program

5

was in the user files as opposed to the programs file on the

6

computers you found?

7

A.

Correct.

8

Q.

If the user attempted to put WGet on the programs file,

9
10
11
12
13

what would have happened?
A.

They would ask for permission.

They would ask for

administrator privilege or account to do this.
Q.

Assume -- Well, did the user in this case have an

administrative privilege account?

14

A.

No.

15

Q.

If the user tried to put that program on a program drive

16

without going through that process that you just described, would the

17

computer let him?

18

A.

No.

19

MJ:

All right.

20

ATC[CPT MORROW]:

No, Your Honor.

21

ADC[CPT TOOMAN]:

No, ma'am.

22

MJ:

23

ATC[CPT MORROW]:

All right.

Any further questions based on mine

Temporarily excusal?
Temporary, Your Honor.

8009

11559

1

[The witness was temporarily excused, duly warned, and withdrew from

2

the courtroom.]

3

ATC[CPT WHYTE]:

Ma'am, the United States calls Mr. Chad

4

Madaras.

5

CHAD MADARAS, was called as a witness for the prosecution, was sworn,

6

and testified as follows:
DIRECT EXAMINATION

7
8

Questions by the assistant trial counsel [CPT WHYTE]:

9

Q.

You are Chad Madaras from Caseville, New York?

10

A.

Yes, sir.

11

Q.

Mr. Madaras, what is your current military status?

12

A.

I'm inactive ready reserves, sir.

13

Q.

When did you leave the military?

14

A.

January 16th 2013.

15

Q.

And how long did you serve for?

16

A.

Approximately 6 years, sir.

17

Q.

What was your MOS during that time?

18

A.

I was a 35 Fox Intel Analyst.

19

Q.

For the entire 6 years?

20

A.

Yes, sir.

21

Q.

And where were you stationed?

22

A.

At Fort Drum.

23

Q.

Do you remember when you arrived at Fort Drum?

8010

11560

1

A.

November of 2007.

2

Q.

When you arrived what unit were you assigned to?

3

A.

Second Brigade, sir.

4

Q.

Of 10th Mountain Division?

5

A.

Yes, sir.

6

Q.

And how did you know PFC Manning at Fort Drum?

7

A.

I didn't really know him that well at Fort Drum.

8

just met him once in the smoking area outside our barracks.

9

Q.

Did you deploy out of Fort Drum?

10

A.

Yes, sir.

11

Q.

And what pre-deployment training did you receive?

12

A.

I had two JRTC rotations and a DCGS-A course.

13

Q.

The JRTC, when were those?

14

A.

October of 2008 and July of 2009, sir.

15

Q.

Did PFC Manning attend both of those with you?

16

A.

From the best of my recollection, yes.

17

Q.

And you mentioned a DCGS training.

18
19

I had

Can you explain what

that consisted of?
A.

We had a DCGS course that just covered all the fundamentals

20

of a DCGS machine, multi-function work station and how to use all the

21

components of it.

22

Q.

Did PFC Manning attend that with you?

23

A.

Yes, he did.

8011

11561

1
2
3
4

Q.

At this training what were you taught about who was

responsible for handling the DCGS machine in theater?
A.

We were told we have a DCGS FSR downrange with us that

would take care of anything DCGS-A related.

5

Q.

And what is an FSR?

6

A.

Field Support Representative, sir.

7

Q.

How long is this training on the DCGS machine?

8

A.

It was a week long, sir.

9

Q.

So where did you deploy from Second Brigade, or From Fort

10

Drum?

11

A.

What was that, sir?

12

Q.

Where did you deploy to from Fort Drum?

13

A.

FOB Hammer, Iraq, sir.

14

Q.

Did PFC Manning deploy to Hammer as well?

15

A.

Yes, sir.

16

Q.

Do you remember when you arrived at FOB Hammer?

17

A.

Sometime around October 15th 2009.

18

Q.

Do your remember when PFC Manning arrived?

19

A.

It would be about a week or two later, sir.

20

Q.

Where did you work at FOB Hammer?

21

A.

In the Brigade SCIF.

22

Q.

Where did PFC Manning work?

23

A.

In the Brigade SCIF also.

8012

11562

1

Q.

2

assigned to?

3

A.

We were Fusion Cell, part of the Shia team.

4

Q.

What do you mean by we?

5

A.

Me and PFC Manning.

6

Q.

So you both were Shia ----

7

A.

Yes, sir.

8

Q.

---- Intel Analysts working in the SCIF?

9

A.

Yes, sir.

10

Q.

What shift did you work on?

11

A.

I worked day shift.

12

Q.

And what shift did Manning work on?

13

A.

The night shift.

14

Q.

What type of computer did you use at FOB Hammer?

15

A.

We used DCGS-A laptop, Dell.

16

Q.

And how many computers did you have at your work station in

17

And what cell within the -- or what section were you

the SCIF?

18

A.

Just one, sir.

19

Q.

And who did you share that work station with?

20

A.

I shared it with PFC Manning.

21

Q.

What network was this DCGS machine hooked up to?

22

A.

It was on the SIPRNET work, sir.

23

Q.

And who did you share this DCGS SIPRNET machine with?

8013

11563

1

A.

With PFC Manning.

2

Q.

For how long did you share this?

3

A.

For about 6 months.

4

Q.

So, when in the deployment did you share this?

5

A.

When we first took over all the way up until around the

6
7

March timeframe, sir.
Q.

So let's just talk about when you were actually in the

8

SCIF, just to give the Court a time line.

9

October 2009?

You said you arrived 15

10

A.

Yes, sir.

11

Q.

When was the first time that you left the SCIF?

12

A.

Just before Christmas of 2009.

13

Q.

And where did you go?

14

A.

I went to BIAP.

15

Q.

And where -- how long was this?

16

A.

It was about a week long.

17

Q.

And then you returned back to FOB ----

18

A.

Yes, sir.

19

Q.

---- Hammer working in the SCIF?

20

A.

Yes, sir.

21

Q.

When did you next leave FOB Hammer?

22

A.

I left around January 27th or 28th, when I went on R and R.

23

Q.

And how long were you gone for?

8014

11564

1

A.

I returned around February 15th.

2

Q.

What about the next time you left FOB Hammer?

3

A.

I left in March for the parliamentary elections of Iraq.

4

Q.

And how long were you gone for?

5

A.

For a week again, sir.

6

Q.

So when did you stop working in the SCIF?

7

A.

Around the end of May, beginning of June, sir.

8

Q.

Are you familiar with Intelink?

9

A.

Yes, sir.

10

Q.

What is Intelink?

11

A.

It's a separate search engine like Google within SIPR.

12

Q.

Did you use Intelink as a 35 Fox?

13

A.

Yes, sir.

14

Q.

So, what are some of the benefits of using Intelink as a 35

A.

If you didn't have a lot of information on somebody or a

15
16

Fox?

17

name came up in a report that you weren't really sure, you could just

18

throw it in there to see if you got any hits right off the bat.

19
20
21
22

ATC[CPT WHYTE]:

Let the record reflect that I'm retrieving

Prosecution Exhibit 81 from the court reporter.
CDC[MR. COOMBS]:

Your Honor, to the extent that the

government is going to use 81 to ask this witness did he do any of

8015

11565

1

those searches, we would stipulate that he did not do any of those

2

searches.

3

MJ:

4

ATC[CPT WHYTE]:

5

All right.

Is that where you were going with this?
Yes, Your Honor.

But it may be helpful to

the Court to actually hear what searches Mr. Madaras did not search.

6

TC[MAJ FEIN]:

7

MJ:

Why?

May we have a moment, Your Honor?

Okay.

8

[There was a pause while the trial counsel consulted with the

9

assistant trial counsel.]

10

MJ:

Why would it be beneficial?

If the defense is stipulating

11

that the witness did not do any of those searches, why would it be

12

beneficial for me to listen to the particular searches that he did

13

not do?

14

ATC[CPT WHYTE]:

15

that witness.

16

MJ:

17

Yes, ma'am.

Never mind, we will not ask

Proceed.

Questions continued by the assistant trial counsel [CPT WHYTE]:

18

Q.

Mr. Madaras, did you use CIDNE-Iraq to pull intelligence?

19

A.

Yes, sir.

20

Q.

Are you aware if there's a CIDNE-Afghanistan?

21

A.

There is, sir.

22

Q.

Did you use CIDNE-Afghanistan?

23

A.

No, sir.

8016

11566

1

Q.

Why not?

2

A.

It did not really pertain to anything we were doing in our

Q.

Did you use Net-Centric diplomacy to search for any

3
4
5

area.

intelligence?

6

A.

No, sir.

7

Q.

Did you pull any Department of State cables?

8

A.

No, sir.

9

Q.

What region of the world were you focused on when you were

10

at FOB Hammer?

11

A.

Eastern Baghdad.

12

Q.

Did you ever search for intelligence on Iceland?

13

A.

No, sir.

14

Q.

How about South America?

15

A.

No, sir.

16

Q.

Europe?

17

A.

No, sir.

18

Q.

Africa?

19

A.

No, sir.

20

Q.

East Asia?

21

A.

No.

22

Q.

And why not?

8017

11567

1
2

A.

It did not pertain to anything we were doing in eastern

Baghdad.

3

Q.

Are you familiar with WGet?

4

A.

No, sir.

5

Q.

Let's talk about some of the issues that you had with your

6

computer when you were at FOB Hammer.

7

what type of problems you had with your computer at FOB Hammer?

8
9
10

A.

During your deployment explain

The computer used to crash on a regular basis or operate

really, really slowly to the point where it was difficult to get any
work done.

11

Q.

And how often did you have these computer problems?

12

A.

About twice a week.

13

Q.

So can you please explain to the Court during those two

14
15

times per week you showed up for a shift change, what happened?
A.

When I'd log on to the computer, it would run really slow,

16

wouldn't really load up anything that I was trying to use to complete

17

my work, and then sometimes it would just completely crash.

18

Q.

And when did you notice these computer problems?

19

A.

It was right off the bat at the beginning of shift.

20

Q.

So what would you do when you had these computer problems?

21

A.

I'd get Alan Milliman and have him to work on the machine.

22

Q.

And who was Mr. Milliman?

23

A.

He was our DCGS FSR.

8018

11568

1

Q.

What would Mr. Milliman do to fix the machines?

2

A.

He'd usually have to re-image the system.

3

Q.

After Mr. Milliman worked on the computer, can you describe

4

how the computer operated?

5

A.

It would operate like brand new again.

6

Q.

How did it operate for the remainder of your shift?

7

A.

It would operate well.

8

Q.

What about the following day?

9

A.

It would slowly start to deteriorate.

10

Q.

How many times did Mr. Milliman re-image your computer?

11

A.

Probably about five times, sir.

12

Q.

And what was your understanding of why you were having

13

these computer problems?

14

CDC[MR. COOMBS]:

15

MJ:

16

Is -- Did this witness get his understanding from somebody

else?

17

ATC[CPT WHYTE]:

18

MJ:

19

ATC[CPT WHYTE]:
matter asserted.

21

in response to that.
MJ:

Yes, Your Honor.

What's the hearsay exception?

20

22

Objection, Your Honor. Calls for hearsay.

It's actually not for the truth of the

It's effect on the listener, what Mr. Madaras did

And the question was again?

8019

11569

1
2
3

ATC[CPT WHYTE]:

The question was what was your understanding

as to why you were having these computer problems.
MJ:

Why don't you just ask him after you understood why you

4

were having the computer problems what did you do next?

5

Questions continued by the assistant trial counsel [CPT WHYTE]:

6
7
8
9

Q.

After you understood -- After you knew that you were having

these computer problems, what did you do next?
A.

I asked PFC Manning to try to remove some of the unneeded

documents off his desktop, and I also did so myself.

10

Q.

Did you look at PFC Manning's desktop?

11

A.

I couldn't see the desktop, but I could see the file size.

12

Q.

And how would you describe the file size?

13

A.

It was very large.

14

Q.

What did you store on your desktop?

15

A.

I would store any project that I was currently working on,

16

so Power Points and any reports that I needed to work on the project.

17

Q.

So what did you do to reduce your desktop size?

18

A.

Anything that was from previous project I was working on I

19
20
21
22

went ahead and I deleted them, got rid of them.
Q.

So after you told PFC Manning to limit the amount on his

desktop, did you have problems after that?
A.

Yes, I still did.

8020

11570

1
2
3

Q.

How did your computer problems affect your ability to work

at FOB Hammer?
A.

It would take about 2 hours of my work schedule for Alan to

4

figure out what was wrong with it, and if he had to re-image it it

5

would take approximately 2 hours.

6
7
8
9

Q.

And how often did other 35 Foxes have problems with their

computers?
A.

Everybody had one about once throughout their entire

deployment.

10

Q.

Do you remember when you stopped sharing a computer with

11

PFC Manning?

12

A.

13

ATC[CPT WHYTE]:

14

MJ:

It was when I returned from the elections in March of 2010.

Defense?

Proceed.
CROSS-EXAMINATION

15
16
17
18

No further questions, Your Honor.

Questions by the civilian defense counsel [MR. COOMBS]:
Q.

Sergeant Madaras, well, I’m sorry I got used to calling you

Sergeant Madaras.

Mr. Madaras, you first met PFC Manning in 2008?

19

A.

Yes, sir.

20

Q.

And this was out in a smoking area outside the barracks at

21
22

Fort Drum?
A.

Correct, sir.

8021

11571

1
2

Q.

And based upon those times that you spoke with PFC Manning,

you recall him being interested in U.S. politics?

3

A.

Yes, sir.

4

Q.

And the way he talked, you got the impression that he was

5

interested in going into politics?

6

A.

Not that I can remember, sir.

7

Q.

Do you recall telling me that based upon the way he talked

8

you got the impression that he was interested in going in?

9

A.

No, sir.

10

Q.

And during those times that you spoke with him, he never

11

said anything that gave you the impression that ----

12

TC[MAJ FEIN]:

Objection, Your Honor.

13

MJ:

14

CDC[MR. COOMBS]:

Hearsay.

Yes.
I'm not asking for a response, I’m asking

15

for -- if I could finish my question, and then I think the objection

16

may be appropriate to ----

17

MJ:

What is the question?

18

CDC[MR. COOMBS]:

---- make it at that point.

During the

19

times you spoke with him, he never gave you the impression that he

20

held any anti-American positions.

21

MJ:

All right.

I'll allow that.

22
23

8022

Go ahead.

11572

1

Questions continued by the civilian defense counsel [MR. COOMBS]:

2

A.

No, sir.

3

Q.

Now, you and PFC Manning both went to JRTC in 2009?

4

A. Yes, sir.

5

Q.

6

And JRTC was the training that you received in preparation

for deployment to Iraq?

7

A.

Yes, sir.

8

Q.

And at JRTC the two of you worked opposite shifts?

9

A.

Correct, sir.

10

Q.

You worked the night shift?

11

A.

Yes, sir.

12

Q.

And PFC Manning worked the day shift?

13

A.

Yes, sir.

14

Q.

And at JRTC, PFC Manning was in charge of working on the

15
16
17
18
19

company's computers if there was any problems?
A.

I don't know if he was in charge of working on the

computers, sir, but he may have worked on computers, yes.
Q.

All right.

Well let’s go with what you -- you know he

worked on the company's computers at JRTC?

20

A.

Yes, sir.

21

Q.

He unlocked some of the computer passwords for the S-2

22
23

section?
A.

Not that I remember at this time, sir.

8023

I don't know.

11573

1

Q.

Do you recall telling me that he unlocked ----

2

A.

I don't remember.

3

Q.

Let me finish my question.

4

Do you recall telling me that

he unlocked some of the computer passwords at the S-2 section?

5

A.

I do not remember that, sir.

6

Q.

When you say you don't remember, are you saying I don't

7

remember now because my memory is failing, or I don't remember it

8

because I don't think I ever said that to you?

9
10
11

A.

I don't remember it because memory is failing from that

long ago, sir.
Q.

Okay.

Now, the times in which he was working on the

12

computers, did anyone to your memory go in and say, stop, you're not

13

permitted to do that?

14

A.

No, sir.

15

Q.

And he was very good at working on the computers, correct?

16

A.

Yes, sir.

17

Q.

And what type of computers did you work off as an analyst

18

at JRTC?

19

A.

DCGS-A computers.

20

Q.

Now, in Iraq you also had DCGS-A computers, correct?

21

A.

Yes, sir.

22

Q.

And you're not really a computer guy, is that right?

23

A.

Correct.

8024

11574

1
2

Q.

You don't know much about computers beyond basically the

basic operating system?

3

A.

Correct, sir.

4

Q.

But you knew that PFC Manning would occasionally work on

5

the DCGS-A computers in Iraq?

6

A.

Possibly, sir.

7

Q.

Possibly meaning what?

8

A.

It's possible that he did.

9

Q.

And I'm sorry to pin you down.

I'm sorry.
I don't remember.
Are you saying you don't

10

remember because so much time has gone by, or are you saying you

11

don't remember because you don't believe he ever worked on the DCGS-A

12

computers?

13

A.

So much time has gone by.

14

Q.

You don't recall that?

15

A.

I don't recall, yes.

16

Q.

Do you ever recall telling me that on the phone?

17

A.

No.

18

Q.

Now, did you -- do you recall telling me that you saw him

19

go into the operating system and try to make the computer run faster?

20

A.

No, sir.

21

Q.

You don't recall telling me that?

22

A.

No, sir.

8025

11575

1
2

Q.

We talked a little over now about 2 and a half weeks ago.

You don't recall telling me that at that point?

3

A.

I didn't talk to you about 2 and a half weeks ago, sir.

4

Q.

When's the last time you recall?

5

A.

It was probably about 2 years ago before the Article 32

6

hearing was the last time I recall talking to you.

7

Q.

That's the last time you recall talking to me?

8

A.

Yes, sir.

9

Q.

Okay.

Do you recall telling me that you witnessed him go

10

into the task manager and change what programs are running and how

11

they started?

12

A.

I'm not sure, sir.

13

Q.

Not sure meaning you don't recall that?

14

A.

Meaning I don't recall, sir.

15

Q.

Okay.

16

Do you recall telling me that you witnessed him help

others with their DCGS-A computers?

17

A.

Yes, sir.

18

Q.

All right.

And we'll talk about that in a moment, but when

19

he was helping others, no one stepped in and said, hey, you can't do

20

that, that's not permitted?

21

A.

Correct, sir.

22

Q.

Now, you said your computer would crash occasionally?

23

A.

Yes, sir.

8026

11576

1

Q.

2

information?

3

A.

Yes, sir.

4

Q.

So would you agree with me that analysts were encouraged to

5

And sometimes I imagine when it crashed you lost

save information on the T-drive?

6

A.

Yes, sir.

7

Q.

And the T-drive was the shared drive that everyone had

8

access to?

9

A.

Yes, sir.

10

Q.

And analysts were also encouraged if they wanted to save

11

information on a CD?

12

A.

Yes, sir.

13

Q.

And, of course, because it was your computer, your DCGS-A

14

computer, you would save information on the desktop of your computer

15

if you wanted?

16

A.

Yes, sir.

17

Q.

That was permitted?

18

A.

Yes, sir.

19

Q.

Now, I want to talk about some of the times you witnessed

20

others being helped by PFC Manning on the DCGS-A computer, okay?

21

A.

Yes, sir.

22

Q.

Now, the first time -- well, actually one of the times was

23

dealing with mIRC chat, is that correct?

8027

11577

1

A. Yes, sir.

2

Q.

3

And mIRC chat is one of those baseline programs that you

didn't have on your DCGS-A computer, right?

4

A.

Correct, sir.

5

Q.

But analysts needed mIRC chat to do their job?

6

A.

Correct.

7

Q.

And that's because you as an analyst in the S-2 section

8

would speak to others who were using mIRC chat?

9

A.

Correct.

10

Q.

So do you recall having PFC Manning set up mIRC chat on

11

your computer?

12

A.

Yes, sir.

13

Q.

And do you recall him doing that for others?

14

A.

Yes, sir.

15

Q.

And mIRC chat, when you did that, it was put on your

16

computer basically as something that you would double click to start

17

on the desktop?

18

A.

Yes, sir.

19

Q.

And you're sure PFC Manning did this and not Mr. Milliman?

20

A.

Yes, sir.

21

Q.

And when PFC Manning did this for you and others,

22
23

did

anyone step in, to your memory, and say, hey, that's not permitted?
A. No, sir.

8028

11578

1
2

Q.

Now, at Fort Drum you attended DCGS-A training with PFC

Manning?

3

A.

Correct.

4

Q.

And do you recall who taught this training to you?

5

A.

I do not, sir.

6

Q.

Does MIT teams sound correct to you?

7

A.

Yes, sir, it would.

8

Q.

And do you recall what a MIT team was?

9

A.

No, I don't.

10

Q.

Did you ever receive any training on what you could and

11

could not add on the desktop of your DCGS-A computer?

12

A.

Not that I recall.

13

Q.

And just for the judge, I want to make sure it's not that

14

you recall, meaning I can't remember if we did, or I don't remember

15

we ever did receive that training?

16

A.

Yeah.

I don't remember, sir.

17

Q.

All right.

Did you ever receive any training discussing

18

what you could and could not place on your desktop like mIRC chat,

19

like an executable file?

20

A.

No, I do not.

21

Q.

And, again, is that you don't remember that, or you don't

22
23

believe you received that training?
A.

I don't believe we received that training.

8029

11579

1
2

Q.

Okay.

And during the deployment did anyone say to you that

you could not put mIRC chat on your desktop as an executable file?

3

A.

No, they did not.

4

Q.

Did you receive any training either at Fort Drum or during

5

the deployment on how you had to download information from the

6

SIPRNET?

7

A.

Not that I remember, sir.

8

Q.

Was there any formal, you know, guidance or statement to

9
10

you that you had to download information in one particular way, like
click, open, save?

11

A.

No.

12

Q.

Do you know what exporting with Excel is?

13

A.

Yes, sir.

14

Q.

And could you tell the judge what that is?

15

A.

You'd take a document and export it into Excel, is that the

16

one you're ----

17

Q.

Yes.

18

A.

And then it would make a sheet for you where it would list

19

everything to like upload grid coordinates into an ARC map or

20

something, as an example.

21
22

Q.

And when you were exporting large documents, like if you

were exporting a month of SIGACTs or something to Excel, did you have

8030

11580

1

to click, open and save every one of the SIGACTs or would the Excel

2

export it for you?

3

A.

The Excel would export it for us.

4

Q.

So it would do it automatic -- in an automated fashion.

5

A.

Yes, sir.

6

Q.

Is that correct?

7

A.

Yes, sir.

8

Q.

Did anyone tell you that that was improper, that you're

9
10

supposed to go and click, open and save and not use the automated
process?

11

A.

No.

12

Q.

And from your memory, was that permitted?

13

A.

Yes, sir.

14

Q.

Now, you were a part of the advance party for Bravo Company

15

going to Iraq.

Is that right?

16

A.

Correct.

17

Q.

And if I'm correct, you departed Fort Drum sometime in

18

October of 2009?

19

A.

Yes, sir.

20

Q.

And then you arrived at FOB Hammer around the 15th of

21
22

October?
A.

Yes, sir.

8031

11581

1
2

Q.

And when you arrived, you worked periodically in the SCIF.

Is that right?

3

A.

Right.

4

Q.

You also had to support your company's operations?

5

A.

Correct.

6

Q.

So initially you did not work full-time in the SCIF?

7

A.

That's correct.

8

Q.

And when you were in the SCIF, you worked as an

9

Intelligence Analyst?

10

A.

Correct.

11

Q.

And I believe you said you were on the Shia threat group?

12

A.

Yes, sir.

13

Q.

And obviously PFC Manning was also on that?

14

A.

Yes.

15

Q.

And at the start of the deployment you worked the day

16

shift?

17

A.

Yes.

18

Q.

And PFC Manning worked the night shift?

19

A.

Yes, sir.

20

Q.

Now, on the night shift PFC Manning had certain tasks that

21
22

he was, I guess had to complete.
A.

Is that correct?

Correct.

8032

11582

Q.

1

And he and the other night shift analysts were tasked to

2

complete and update what I believe was called a commander's read book

3

each night.

Is that right?

4

A.

Yes, that's correct.

5

Q.

And he also had to do a report slide that was due every

6

night?

7

A.

Yes.

8

Q.

And for the slide PFC Manning and others had to do

9

analysis?

10

A.

Correct.

11

Q.

And that slide was due every night at midnight?

12

A.

Yes, sir.

13

Q.

And these were products that he was required to complete?

14

A.

That's correct.

15

Q.

Now, at any point when you were working in the T-SCIF, did

16

they put out any formal training on the rules and regulations of the

17

SCIF?

18

A.

Not that I recall, sir.

19

Q.

So when you say again -- when you say not that you recall,

20

meaning they could have and I don't remember it, or I don't believe

21

they ever did that?

22

A.

They could have and I don't remember it.

8033

11583

1
2

Q.

From your memory, did you ever see Soldiers listening to

music in the SCIF?

3

A.

Yes.

4

Q.

And where was this music stored?

5

A.

It was stored on the T-drive.

6

Q.

And that was a classified drive, correct?

7

A.

Correct.

8

Q.

Did you ever see the Soldiers place that music on their

9

DCGS-A computers?

10

A.

I didn't see them place it on the DCGS-A computers, no.

11

Q.

Did you ever see the Soldiers listening to the music on the

12

DCGS-A computers?

13

A.

Yes, sir.

14

Q.

Did you ever see movies in the T-SCIF?

15

A.

Yes, sir.

16

Q.

And did you ever see Soldiers playing movies in the T-SCIF?

17

A.

Yes.

18

Q.

Did you ever see games being played in the T-SCIF?

19

A.

Yes, sir.

20

Q.

Video games?

21
22

And were these being played on the DCGS-A

computer?
A.

Yes, sir.

8034

11584

1
2

Q.

And from your memory, was anyone ever punished for having

games, music or movies in the T-SCIF?

3

A.

No.

4

Q.

And we talked about the fact that others had had mIRC chat

5

added on to their desktop computer, right?

6

A.

Yes.

7

Q.

Was anyone ever punished for having mIRC chat put on their

8

desktop?

9

A.

No.

10

Q.

Did anyone ever say that that was wrong?

11

A.

No.

12

CDC[MR. COOMBS]:

13

MJ:

14

ATC[CPT WHYTE]:

17
18

Thank you.

Redirect?
Yes, ma'am, just a few questions.
REDIRECT EXAMINATION

15
16

All right.

Questions by the assistant trial counsel [CPT WHYTE]:
Q.

Mr. Madaras, you said that PFC Manning helped other

Soldiers with their DCGS machines?

19

A.

Yes.

20

Q.

How did he help the other Soldiers?

21

A.

From all I can remember was helping with mIRC chat.

22

Q.

And why was he asked to help the Soldiers?

8035

11585

A.

1
2

at other FOBs.
Q.

3
4

Because we needed mIRC chat so we could talk to other units

So let's talk about mIRC chat.

You said you had it on your

DCGS machine?

5

A.

Yes, sir.

6

Q.

Where was it located on your machine?

7

A.

Right off the desktop.

8

Q.

Okay.

9

A.

Everybody did, sir.

10

Q.

In the S-2 shop?

11

A. Yes, sir.

12

Q.

What about outside of the S-2 shop?

13

A.

Anybody that worked in direct relation to us like current

14

ops at other units and their S-2s at other units all had mIRC chat.
Q.

15
16

And who else had mIRC chat on their computer?

Can you explain for the Court what mIRC chat looks like

when you actually open it up?
A.

17

When you open it up there's a bunch of listings on the left

18

side of the screen that has all the different chat groups in it.

19

the center it's a blank space so when you click to it it opens it up

20

so you can see that group, and at the bottom is where you type in

21

what you want to say.
Q.

22
23

And what type of information was communicated over mIRC

chat?

8036

In

11586

1
2

A.

Mainly SIGACTs that was currently happening before they

were even published on the CPOF.

3

Q.

So why was this information communicated over mIRC chat?

4

A.

Because the sooner we would know about stuff, the more

5
6
7

effect we could have on the battle you could say.
Q.

You said that mIRC chat was stored on the T-drive.

correct?

8

A.

Yes, sir.

9

Q.

Do you know when mIRC chat was put on the T-drive?

10

A.

I don't.

11
12
13

Is that

It was already on there from the previous unit

when we got in country.
Q.
issue.

And then the defense asked you about the Excel export
Did CIDNE, the program itself, allow you to export SIGACTs?

14

A.

Yes, sir, you could then pour them directly into Excel.

15

Q.

And also movies, music, games, that was also asked by the

16

defense.

Do you know when that information was put on the T-drive?

17

A.

18

ATC[CPT WHYTE]:

19

MJ:

20

CDC[MR. COOMBS]:

21

That was on the T-drive from the previous unit.
No further questions, Your Honor.

Go ahead.
Just one follow-up.
[END OF PAGE]

22

8037

11587

RECROSS-EXAMINATION

1
2
3
4

Questions by the civilian defense counsel [MR. COOMBS]:
Q.

The DCGS-A computer, did anyone besides Intelligence

Analysts have DCGS-A computers?

5

A.

I do not know, sir.

6

Q.

Were DCGS-A computers, computers that were part of what you

7

did as Intelligence Analysts?

8

A.

Yes, sir.

9

Q.

Would a person who didn't have a job that dealt with

10

Intelligence Analysts be working off a DCGS-A computer?

11

A.

No, sir.

12

CDC[MR. COOMBS]:

13

MJ:

14

ATC[CPT WHYTE]:

15

MJ:

Any last redirect?

18
19

No, ma'am.

Mr. Madaras, I have a few questions.
EXAMINATION BY THE COURT-MARTIAL

16
17

Thank you.

Questions by the military judge:
Q.

The DCGS-A computers that were down range, you testified

earlier there's a T-drive and that T-drive stored mIRC chat.

20

A.

Yes, ma'am.

21

Q.

So the T-drive was accessible to all users, but were your

22

individual user drives or your user profiles accessible to your

23

colleagues?

8038

11588

1

A.

If we saved them on to the T-drive they were, ma'am.

2

Q.

So did you -- You said -- you testified PFC Manning helped

3

you install mIRC chat on your desktop.

4

the T-drive?

5

A.

6

Was that as a shortcut from

That would be as a shortcut, ma'am, yes, from my

understanding.
Q.

Was there a separate mIRC chat on your user profile as

9

A.

I do not know.

10

Q.

When you used mIRC chat, where did you use it from?

11

A.

Right off my desktop.

12

Q.

You testified earlier that music, books and games were

7
8

well?

13

already on the T-drive from the previous unit.

Did any of the

14

members of the SCIF, are you aware, did anybody put new movies, games

15

or videos on the T-drive?

16

A.

Not that I know of, no.

17

Q.

Do you know if there was any authorization or prohibition

18

from -- any authorizing to do that -- authorization to do that or

19

prohibition against doing that?

20

A.

No, ma'am, I do not know.

21

Q.

So there was basically silence on the issue?

22

A.

Correct.

23

Q.

Who supervised you?

8039

11589

1

A.

Kyle Balonek did.

2

Q.

Would Mr. Balonek have been aware if someone was watching -

3

- of people watching these movies and playing these games from the T

4

drive.

5

A.

Yes, I would believe so.

6

Q.

When you testified earlier that Mr. Milliman I believe his

7

name was would come and help you fix the computer problems that you

8

had when you had them?

9

A.

Yes.

10

Q.

Did -- And he would re-image them to do that.

11

Is that what

you said?

12

A.

Yes, that's correct.

13

Q.

When someone re-images a computer, what happens to the data

14
15
16
17
18

that you have?
A.

Wipes -- From my understanding it gets rid of everything

like starting fresh.
Q.

So, if you needed -- Were you ever in a situation where you

needed data from your computer before it was re-imaged?

19

A.

Yes.

20

Q.

What did you do with that data?

21

A.

We'd save it to a CD.

22

Q.

And what would you do with the CD?

8040

11590

1

A.

It would go into the computer again once he was done re-

2

imaging it and re-save all the files to the computer that were

3

needed, ma'am.

4
5

Q.

Now, when the computer is re-imaged, does it strip data

from the T-drive, too?

6

A.

No.

7

Q.

So the re-imaging would just be for your user profile?

8

A.

Just for the computer, anything that was saved on that

9

The T-drive was a completely separate function.

computer's hard drive.

10

Q.

So the T-drive is a shared drive located somewhere else?

11

A.

Correct.

12

Q.

If the computers would go down frequently, why would you

13
14
15
16

not save everything on the T-drive?
A.

We usually tried to save most everything that we were

working on on the T-drive, ma'am.
Q.

You testified earlier that you didn't do any searches of

17

Europe and Iceland and all of the other areas that you talked about

18

because it wasn't in your particular area of operations.

19

understanding of, say you had down time, instead of watching a movie,

20

you wanted to see what was going on in the world, for example.

21

is your understanding of what the policy, if any, was with respect to

22

you searching things that didn't have anything to do with your AO?

23

A.

What's your

What

I don't believe there was any stipulation against doing so.

8041

11591

1

MJ: Any questions based on mine?

2

CDC[MR. COOMBS]:

3

TC[MAJ FEIN]:

4

MJ:

5

ATC[CPT WHYTE]:

6

MJ:

No, Your Honor.

No, Your Honor.

All right.

Anything else for this witness?
No, ma'am.

All right.

7

[The witness was temporarily excused, duly warned, and withdrew from

8

the courtroom.]
MJ:

9

All right.

Counsel, I'm looking at the time, I'm also

10

looking at a stack of stipulations of expected testimony that I have

11

here.

12

expected testimony with PFC Manning and then break for a lunch, or

13

would you rather break for lunch and then go through it afterwards?

14

Would this be a good time to go through the stipulations of

TC[MAJ FEIN]:

Ma'am, the United States recommends that we break

15

for lunch, for a 2-hour lunch recess because we have more

16

stipulations and then we can put them all together and do them at one

17

time after lunch.

18

MJ:

19

CDC[MR. COOMBS]:

20

MJ:

21

Any objection to that?
No, Your Honor.

Anything else we need to address before we go into a 2-hour

recess?

22

TC[MAJ FEIN]:

No, ma'am.

23

CDC[MR. COOMBS]:

No, ma'am.

8042

11592

1

MJ:

All right.

Court will reconvene then at 1400 or 2 o'clock.

2

Court is in recess.

3

[The court-martial recessed at 1211, 10 June 2013.]

4

[The court-martial was called to order at 1524, 10 June 2013.]

5

MJ:

Court is called to order.

6

TC[MAJ FEIN]:

Yes, ma'am.

Major Fein?

All parties when the Court last

7

recessed are again present, Your Honor, with the following exception

8

Captain Whyte is absent and Captain Overgaard is present.

9

MJ:

All right.

During the lunch recess that went a little bit

10

longer, or a lot longer than we had planned.

11

presented me with some stipulations of expected testimony that both

12

sides have agreed to and that PFC Manning has agreed to.

13

total of 19.

TC[MAJ FEIN]:

15

ADC[MAJ HURLEY]:

16

TC[MAJ FEIN]:

18
19
20
21
22

I count a

Do both sides?

14

17

The parties have

Yes, ma'am.
Yes, ma'am.

And, ma’am, that's 19, one classified, and then

there's an unclassified redacted version as well, but it's the same.
MJ: Major Hurley, I need to go over these stipulations with PFC
Manning.

Does he have them in order of appellate exhibit number?

ADC[MAJ HURLEY]:

Ma’am, he has them in order of prosecution

exhibits numbers.
MJ:

I’m sorry, prosecution exhibit number.

8043

Excuse me.

11593

1
2
3

ADC[MAJ HURLEY]

Yes, ma'am.

May we wait a second just to

make sure that's right.
MJ:

Yeah.

I will do it any order you would like.

I can do it

4

alphabetically, I can do it by appellate exhibit [sic] or whatever

5

makes sense to you will make sense to me.

6

ADC[MAJ HURLEY]:

Ma’am, I apologize.

What we've done is

7

we've set them up in order of the witness testimony according to the

8

witness list proposed by the government.

9

they're currently in now.

10
11
12
13
14

MJ:

So that's the order that

Will it be faster for you all to just take my copies and

match them to his order?
ADC[MAJ HURLEY]:

Ma'am, I think it will be faster if we took

our copies and matched them to the prosecution ID numbers.
MJ:

All right.

15

[There was a brief pause while the defense counsel and accused

16

reviewed the prosecution exhibits.]

17

ADC[MAJ HURLEY]:

18

MJ:

Thank you.

Ma'am, we did our best.
PFC Manning, the one question I do want to ask

19

you before we begin our colloquy, is there's 19 of these stipulations

20

of expected testimony and as I hold them in my hand they can be the

21

size basically of a small paperclip that could hold them together.

22

Have you had an opportunity to read each one of these 19

23

stipulations, and do you feel like you have had enough time to go

8044

11594

1

through all of these that you are comfortable having that colloquy

2

now?

3

ACC: Yes, ma'am, definitely.

4

MJ:

I know some are dated 7 June and some are dated 9 and 10

5

June, and I just noticed here on my copy at least of the redacted

6

classified version doesn't have a date.

7

a reason?

8
9

TC[MAJ FEIN]:

My copy of June, is that for

No, ma'am, the original classified version is

dated 10 June.

10

MJ:

Okay.

So the redacted version will be 10 June too?

11

ADC[MAJ HURLEY]:

12

MJ:

Yes, ma'am.

Now that we're looking at that one, I also was advised by

13

the parties who came into my office briefly for an R.C.M. 802

14

conference that lasted about 2 minutes, that a couple of these

15

stipulations, and this is -- let’s look at the one for Lieutenant

16

Commander Hoskins, the redacted copy of 111B, on Page 2.

17

in Paragraph 8.

18

87 for Identification.

19

normally when you have stipulations of expected testimony and you

20

made handwritten notes or changes on it, PFC Manning, you would

21

initial it, and the government would initial it; but this looks like

22

it was just added as part of the original stipulation.

23

understanding of the parties?

If you look

It has Prosecution Exhibit and then it's handwritten
The parties advised me in the 802 conference,

8045

Is that the

11595

1

ADC[MAJ HURLEY]:

Yes, ma'am, we received them from the

2

government, they had already handwritten in the prosecution exhibit

3

the time we reviewed it and signed it.

4

MJ:

5

TC[MAJ FEIN]:

6

MJ:

7

ACC: Yes, ma'am.

8

MJ:

9
10
11

That is correct.
Yes, ma'am.

And PFC Manning Do you agree?

All right.

So basically you had the stipulations, you just

didn’t know what the appellate exhibit [sic] number, or the ones we
were referring to were at that particular time.
ADC[MAJ HURLEY]:

Yes, ma'am.

As we were going back and forth

12

on content and then once we got down to the specifics that’s when it

13

was actually filled in prior to signature.

14
15

MJ:

Okay.

Does either side see a necessity to go through and

initial these?

16

ADC[MAJ HURLEY]:

17

TC[MAJ FEIN]:

18

MJ:

The defense does not, ma'am.

No, ma'am, not for all my people.

All right.

Let's -- Again, let’s just go through them one-

19

by-one to make sure we're both talking about the same thing. I have

20

Prosecution Exhibit 70 for Identification, which is stipulation of

21

expected testimony from Mr. Peter Artale.

22

TC[MAJ FEIN]:

23

MJ:

Artale.

Is it Artail or Artale?

Artale, ma'am.
And PFC Manning do you have that one?

8046

11596

1

ACC: Yes, ma'am.

2

MJ: And the second one I have is a Mr. Sean Chamberlin.

3

Do you

have that one as Prosecution Exhibit 71.

4

ACC: Yes, Your Honor.

5

MJ:

The next one I have is a stipulation of expected testimony

6

of Special Agent John Wilbur, which is Prosecution Exhibit 72 for

7

Identification.

8

ACC: Yes, Your Honor.

9

MJ:

10

All right.

The next one is James Fung, Prosecution Exhibit

73 for Identification.

11

ACC: Yes, Your Honor.

12

MJ:

13

All right.

Exhibit 74 for Identification.

14

ACC: Yes, ma'am.

15

MJ:

16

The next one is Alex Withers, Prosecution

All right.

Mr. James McManus, 7 June 2013, Prosecution

Exhibit 75 for Identification.

17

ACC: Yes, Your Honor.

18

MJ: The next one is Special Agent Troy Bettencourt, Prosecution

19

Exhibit 76 for Identification.

20

ACC: Yes, ma'am.

21

MJ:

22
23

All right.

The next one is Special Agent Kirk Ellis

Prosecution Exhibit 77 for Identification.
ACC: Yes, ma'am.

8047

11597

1
2

MJ:

All right.

Prosecution Exhibit 78 for Identification.

3

ACC: Yes, ma'am.

4

MJ:

5

Next is one is Mr. Doug Schasteen, Prosecution Exhibit 80

for Identification.

6

ACC: Yes, ma'am.

7

MJ:

8
9
10

The next one is Special Agent Mark Mander,

The next one I have is Prosecution Exhibit 106 for

Identification, Mr. Jacob Grant.
ACC: Yes, Your Honor.
MJ:

All right.

The next one Ms. Florinda White Prosecution

11

Exhibit 107 for Identification.

12

ACC: Yes, Your Honor.

13

MJ:

14

All right.

The next one is Lieutenant Commander Thomas

Hoskins, U.S. Navy Reserve, Prosecution Exhibit 111B, Bravo.

15

ACC: Yes, Your Honor.

16

MJ:

17

Next one is Lieutenant Colonel retired Martin Nehring,

Prosecution Exhibit 112 for Identification.

18

ACC: Yes, ma'am.

19

MJ:

20

Next one is Debra van Alstyne, Prosecution Exhibit 113 for

Identification.

21

ACC: Yes, Your Honor.

22

MJ:

23

Next one is Mr. Wyatt Bora, Prosecution Exhibit 115 for

Identification.

8048

11598

1

ACC: Yes, Your Honor.

2

MJ:

3

Next one I have is Mr. Patrick Hoeffel.

pronounce his name?

4

TC[MAJ FEIN]:

5

MJ:

6

Is that how you

Yes, ma'am.

And that would be Prosecution Exhibit 116 for

Identification.

7

ACC: Yes, Your Honor.

8

MJ:

All right.

And then I have CW5 Jon LaRue, Prosecution

9

Exhibit 117 for Identification.

10

ACC: Yes, Your Honor.

11

MJ:

And then I have Ms. Jacqueline Scott, she should have come

12

before LaRue, but Ms. Jacqueline Scott which is Prosecution Exhibit

13

116 for Identification.

14

ACC: I have 119.

15

MJ:

16

Oh, okay.

Identification.

It looked like a 6 to me.

Is that right?

17

TC[MAJ FEIN]: Yes, ma'am.

18

MJ:

19

Okay.

Again, 119 for

Do you have any other stipulations of expected

testimony before you that I haven't referenced?

20

ACC: No, ma'am.

21

MJ:

And once again, before signing each of these stipulations -

22

- first of all, are the signatures on the back of each of these

23

stipulations.

8049

11599

1

ACC: Yes, ma'am, except for the redacted one.

2

MJ:

3

ACC: Yes.

4

MJ:

5

Okay.

Is your signature on the back of the original?

And that would be for the record Prosecution Exhibit 111

Bravo, Lieutenant Commander Thomas Hoskins.

6

ADC[MAJ HURLEY]:

7

and Alpha is the original.

8

MJ:

9

TC[MAJ FEIN]:

10

All right.
And, ma’am, we do have Alpha for you if you'd

MJ:

Let me just -- before we begin, let me look at that one.

Has PFC Manning, has he had an opportunity to look at 111 Alpha?

13

ADC[MAJ HURLEY]:

14

MJ:

15

Bravo is what we have redacted

like to look at it right now.

11
12

Yes, ma'am.

All right.

Yes, ma'am, he has.
Why don’t you give it to me just so I can see

it.

16

TC[MAJ FEIN]:

17

MJ:

Yes.

May I approach, Your Honor?

I'm looking at a copy of what's been marked as

18

Prosecution Exhibit 111 Alpha.

19

PFC Manning, at the top and bottom of each page, but the substantive

20

redaction that I want to talk about with you is Paragraph 16,

21

redacted in the redacted copy.

22

the Paragraph 16 in the original exhibit?

23

It looks like there are redactions,

Have you had an opportunity to review

ACC: Yes, Your Honor.

8050

11600

1

MJ:

2

ACC: Yes, that's correct.

3

MJ:

4

You've had the opportunity to thoroughly read that?

You can take that back.

19 stipulations before you signed them, did you read them thoroughly?

5

ACC: Yes.

6

MJ:

7

ACC: Yes, ma'am.

8

MJ:

9

ACC: Yes, Your Honor.

10
11

MJ:

Do you understand the contents of the stipulations.

Do you agree with the contents of the stipulations.

All right.

Now, before signing the stipulations, did your

defense counsel explain the stipulations to you?

12

ACC: Yes, Your Honor.

13

MJ:

14

Do you understand you have an absolute right to refuse to

stipulate to the contents of the documents?

15

ACC: Yes, Your Honor.

16

MJ:

17

PFC Manning, with each of these

And that you should stipulate to them only if you believe

it's in your best interest to do that.

18

ACC: Yes, Your Honor.

19

MJ:

Once again, all of these are stipulations of expected

20

testimony, which means that if counsel from both sides and you agree

21

to stipulations of expected testimony, you're agreeing that each of

22

these 19 witnesses if they were sitting here in the witness stand

23

today they would testify substantially as what's in the stipulation

8051

11601

1

of expected testimony that's geared to them and if they were under

2

oath that's exactly how they would testify?

3

the truth of what they're saying.

4

testimony can be -- Their stipulations can be attacked the same way

5

that if the person was testifying here live.

6

contradicted and they can be explained in the same way as if they

7

were here testifying here in live and in court today.

8

understand that?

9
10

You're not agreeing to

Their stipulation and their

They can be

Do you

ACC: Yes, Your Honor.
MJ:

And knowing what I've told you earlier and what your

11

defense counsel has told you and what I've told you today, do you

12

still desire to enter into these stipulations?

13

ACC: Yes, Your Honor.

14

MJ:

15

stipulations?

Do counsel concur with the contents of each of these 19

16

ADC[MAJ HURLEY]:

17

TC[MAJ FEIN]:

18

MJ:

19

through?

20
21
22
23

Yes, ma'am.

All right.

TC[MAJ FEIN]:

Yes, ma'am.

Shall I admit them as evidence now or as we go

Ma’am, we can admit now and then we will read

them as we go through.
MJ:

All right.

Why don’t you hand them to me?

to have my copies?

8052

Would it help

11602

1

ADC[MAJ HURLEY]:

2

MJ:

Thank you.

Yes, ma'am.
All right.

Prosecution Exhibit 70 for

3

Identification a stipulation of expected testimony of Mr. Peter

4

Artale is admitted.

5

stipulation of expected testimony of Mr. Sean Chamberlin is admitted.

6

Prosecution Exhibit 72, Special Agent John Wilbur, for Identification

7

is admitted.
I'm not going say stipulation of expected testimony with

8
9

Prosecution Exhibit 71 for Identification the

each of these.

I'll just say the name.

Prosecution Exhibit 73 for

10

Identification, Mr. John -- James Fung is admitted.

11

Exhibit 74, Mr. Alex Withers, is admitted.

12

Mr. James McManus, is admitted.

13

Agent Troy Bettencourt, is admitted.

14

Agent Kirk Ellis, is admitted.

15

Mark Mander, is admitted.

16

Schasteen, is admitted.

17

CDC[MR. COOMBS:

18

MJ:

Prosecution

Prosecution Exhibit 75,

Prosecution Exhibit 76, Special
Prosecution Exhibit 77, Special

Prosecution Exhibit 78, Special Agent

Prosecution Exhibit 79, Mr. Doug
Wait a minute.
Ma'am, that's Prosecution Exhibit 80.

That is Prosecution Exhibit 80.

Why do I have 79 here?

19

I should not have.

Prosecution Exhibit 79 is not admitted.

Mr.

20

Doug Schasteen, Prosecution Exhibit 80 for Identification is

21

admitted.

22

Prosecution Exhibit 107, Ms. Florinda White, is admitted.

23

Prosecution Exhibits 111 Alpha, which is the classified version,

Prosecution Exhibit 106, Mr. Jacob Grant, is admitted.

8053

79

11603

1

which I can initial later or on a recess, and Prosecution Exhibit 111

2

B for Identification are admitted.

3

Lieutenant Colonel retired Martin Nehring, is admitted.

4

Exhibit 113, Ms. Debra van Alstyne, is admitted.

5

115, Mr. Wyatt Bora, is admitted.

6

Patrick Hoeffel, is admitted.

7

LaRue, is admitted.

8

Scott, is admitted.

Prosecution Exhibit 112,
Prosecution

Prosecution Exhibit

Prosecution Exhibit 116, Mr.

Prosecution Exhibit 117, CW5 John

And Prosecution Exhibit 119, Ms. Jacqueline

Let the record reflect I'm handing all of those exhibits

9
10

back to the court reporter.

11

address before we proceed?

12

TC[MAJ FEIN]:

13

ADC[MAJ HURLEY]:

14

MJ:

15

ATC[CPT MORROW]:

Is there anything that we need to

No, Your Honor.
No, ma'am.

Government, call your next witness.
United States calls Special Agent Mark

16

Mander.

17

SPECIAL AGENT MARK MANDER, U.S. ARMY, was called as a witness for the

18

prosecution, was sworn, and testified as follows:
DIRECT EXAMINATION

19
20

Questions by the assistant trial counsel [CPT MORROW]:

21

Q.

You are Special Agent Mark Mander?

22

A.

Yes.

23

Q.

At the Computer Crimes Investigate Unit, Army CID?

8054

11604

1

A.

Yes.

2

Q.

Agent Mander, how long have you been a CID Agent?

3

A.

I've been an agent approximately 11 years.

4

Q.

And you are a civilian agent at this time?

5

A.

Yes, I'm a civilian agent currently.

6

Q.

And describe your career in CID essentially?

7

A.

Beginning in 1994 I became a CID agent as military or an

8

active duty CID agent, was a military agent for about 4 years, went

9

to the Reserves for 3 years.

I then took a break from both reserves

10

or any military service until joining the Reserves again in 2007, and

11

then in 2008 I became a civilian agent and was also a reserve agent

12

at the same time.

13

Q.

When did you joint CCIU specifically?

14

A.

I was hired as a civilian agent in CCIU in February of

15

2008.

16

Q.

And what training did you receive to become a CID agent?

17

A.

Beginning in 1994, I went to basically the CID School where

18
19
20
21

they teach various aspects of being an agent.
Q.

And what training have you received related to computer

crimes as part of your CCIU job?
A.

Basically all the agents at CCIU go through various

22

training courses at the Defense Cyber Investigations Training

23

Academy, or DCITA.

I've attended approximately, well over 400 hours

8055

11605

1

of courses there.

The courses range from identifying various

2

computer parts and software, doing analysis of computers imagining or

3

obtain forensic images of computers, things of that nature.

4

Q.

What is CCIU's area of expertise in the CID world?

5

A.

CCIU is Army CID's investigative element that is

6

specifically focused on conducting investigations involving computer

7

intrusions and computer crimes.

8

Q.

And what do you mean by an intrusion?

9

A.

Essentially there are many instances or incidents where

10

Army or DoD computer networks are intruded upon where someone will

11

remotely try to get access or does gain access and obviously that is

12

a crime that we investigate.

13

Q.

14

fields?

15

A.

16
17
18

And do you hold any certifications in computer-related

Currently I hold a Department of Defense Certified Computer

Crime Investigator Certification.
Q.

And approximately how many cases have you investigated as a

CCIU agent?

19

A.

Probably in excess of 20.

20

Q.

And what about total in your time at CID, how many cases

21
22
23

have you investigated?
A.

Probably in excess of 200 cases where either I was the

primary agent or I was helping another agent on their case.

8056

11606

1

Q.

Agent Mander, I'd like to discuss the investigation of PFC

2

Manning and WikiLeaks.

3

your role been in the investigation to date?

4

A.

What has been -- or what was and has been

When the investigation first started essentially I was a

5

case agent in the investigation which means I would do various case

6

related investigative duties.

7
8
9

Q.

And how did this investigation compare to other

investigations you've been a part of at CCIU?
A.

For CCIU as well as all of the other investigations that

10

I've participated as a CID agent.

This was probably one of the

11

largest and most complicated investigations we've ever had.

12

Q.

As a case agent, what were you doing day-to-day?

13

A.

My duties involved reviewing various documents, either

14

classified documents or open-source documents, interviewing personnel

15

that had, you know, some relationship or bearing on the

16

investigation, writing reports, collecting evidence, coordinating

17

with various other agencies and other personnel to forward the case.

18
19
20

Q.

And what initially brought PFC Manning to law enforcement's

attention?
A.

Initially in, well towards the end of May of 2010, our

21

office received an e-mail that suggested a Soldier in Iraq had or was

22

or would be wrongfully disclosing classified information.

8057

11607

Q.

1
2

And what organization was initially responsible for the

investigation?
A.

3

Initially it was Army CID was involved.

It wasn't the CCIU

The case was opened by a CID office in Iraq that was

4

initially.

5

assigned the case.

6

Q.

And when did the case get transferred to CCIU?

7

A.

I'm going to say probably the second week of June, I

8

believe it was maybe the 9th or 10th of June or somewhere

9

thereabouts.

10

Q.

11

Aside from the computer nexus, why was the case transferred

to CCIU and your office specifically in the United States?
A.

12

Well, there were several reasons aside from kind of

13

computer aspects even when the investigation was with the office in

14

Iraq.

15

computer forensics related to the case, but as the case developed we

16

started to understand that there was going to be most likely a lot of

17

commercial providers and/or other places within the United States

18

that we would have to get evidence from such as log files and things

19

of that nature.

20

commercial providers like say Google or Microsoft typically to compel

21

them to provide evidence to us, we will get a federal magistrate

22

search warrant, and a federal magistrate was something that was not

It was pretty much understood that CCIU would conduct the

Typically in a case where we have to deal with

8058

11608

1

available in Iraq.

2

So that was another reason that the case was transferred to us.

3
4

Q.

They don't have a federal magistrate over there.

Now, does the CC -- Does the CCIU agents work with the

assistant U.S. attorneys and federal magistrates often?

5

A.

6

ADC[CPT TOOMAN]:

7

MJ:

Overruled.

8

A.

Yes we work with assistant U.S. attorneys and federal

9

Yes, very often, because ---Objection, Your Honor.

Relevance.

Go ahead.

magistrates very often.

Generally because when a computer intrusion

10

incident occurs a lot of times it's not apparent what the source of

11

that intrusion is and, therefore -- it's not always a Soldier,

12

therefore, we wouldn't always deal with a SJA or a trial counsel

13

initially.

14

Q.

Now were there -- Other than sort of the need to interact

15

with the commercial providers in order to obtain search

16

authorizations, any other reasons why the case was better suited for

17

or why the case was transferred to CCIU in the United States?

18

A.

We discussed the obviously computer aspect of it.

The fact

19

that there would be federal magistrates most likely involved to

20

compel the, you know, commercial providers.

21

know, maybe not so obviously, but personnel within the United States

22

that knew Manning.

23

indications that there was persons that he had met with or had been

There was also, you

As well as we also developed there was

8059

11609

1

in contact with in the Boston area during, well, before his time in

2

Iraq as well as during the time he was on leave.

3
4
5

Q.

And how did the evidence get from Iraq to the United States

that was initially collected?
A.

There was -- Initial evidence was collected in Iraq that

6

basically the agents there had collected and that evidence was

7

brought from Iraq via one of the these agents who was going on leave

8

who hand carried the evidence with him from Iraq to the Washington,

9

D.C. area.

I met him in the airport.

10

Q.

You met him at the airport?

11

A.

I did.

12

Q.

And what was that ----

13

MJ:

What airport?

14

Q.

What airport was that?

15

A.

It was Dulles International Airport.

16

Q.

And when approximately was that?

17

A.

I would have to look at the evidence documents.

18

would probably sometime in the second week of June.

19

there I believe.

I mean, it

Right about

20

Q.

And once you met that agent at Dulles what did you do next?

21

A.

We basically inventoried the items that he had hand carried

22

per the evidence vouchers that he also had and then I signed for the

23

items and then I hand carried them to our evidence room at CCIU.

8060

11610

1
2
3

Q.

And once the evidence was in the United States how did the

investigation progress from there?
A.

Initially we looked at various pieces of evidence.

The

4

forensic team of CCIU began examining the evidence that had been

5

received as well as evidence that had been collected in other places.

6

And based on the examination of that evidence, the forensic team

7

would then alert us, the investigative team to leads or investigative

8

matters that needed to be followed up.

9
10

Q.

And at this point when the evidence was transferred, was

the case very well developed?

11

A.

No, the case was just developing essentially.

12

Q.

And what were you -- what were the case agents using to

13

sort of track down leads?

14

examinations by the forensic examiners?

15

A.

What was being revealed by the

Well, for example, on some of the digital media that was

16

collected in Iraq that I believe there were chat logs between PFC

17

Manning and Mr. Lamo that were -- or correspond to chat logs between

18

Mr. Lamo and PFC Manning from digital media that was collected from

19

Mr. Lamo.

20

that was contained on the digital media that being examined such as

21

there was email PFC Manning I believe it was on his personal

22

computer.

So looking at those chat logs as well as other information

Those items of information that were, you know, in those

8061

11611

1

digital media items created investigative leads to identify certain

2

people to interview them.

3
4
5
6
7
8
9

Q.

And what did the chat logs reveal regarding sort of the

scope of the alleged transmissions or compromising information?
ADC[CPT TOOMAN]:

Objection, Your Honor.

This is cumulative.

We’ve already gone over the chat logs.
ATC[CPT MORROW]:

I'm asking a very general question, Your

Honor, to -- for him to provide context to his testimony.
MJ:

Are you going to go down the same road you went before?

10

ATC[CPT MORROW]:

11

MJ:

All right.

12

A.

Can you repeat the question, sir?

13

Q.

What was revealed in the chat logs that provided sort of

14

Absolutely not.
Go ahead.

Overruled.

context to the compromise or the alleged compromises of information?

15

A.

I'm not following, sir.

16

MJ:

Neither am I.

17

Q.

Who was the recipient of information allegedly comprised by

18

PFC Manning?

19

A.

According to the chat logs and other information it

20

appeared that the organization WikiLeaks was the recipient of

21

information.

22

Q.

And what is WikiLeaks?

8062

11612

1

A.

WikiLeaks, to my knowledge, is a organization which its

2

mission is to obtain and publicly display or publish documents from

3

governments and other private organizations.

4
5
6
7
8
9
10

Q.

And when did the WikiLeaks organization become widely

known?
A.

It was probably widely known following the disclosure of a

video involving U.S. Army helicopter involved in combat operation.
Q.

And what was released during that -- what was the release

essentially can you describe what was released by WikiLeaks?
A.

I believe it was on April 5th of 2010, WikiLeaks or members

11

of WikiLeaks held a press conference type of event where they

12

displayed and/or published an edited version of a video taken from an

13

Army helicopter involved in a combat operations.

14

Q.

What do you mean by an, edited video?

15

A.

To my knowledge the video was edited from the original

16
17

video.
ADC [CPT TOOMAN]:

Objection, Your Honor.

This witness has no

18

personal knowledge of any editing that would have been done on the

19

video.

20

MJ:

Hold on.

21

Q.

Agent Mander, are you familiar with the video, the Apache

22

video?

23

this investigation?

Does he?

Have you seen the Apache video in its full form as part of

8063

11613

1

A.

I don't remember having seen the original video, but I know

2

from looking at the version that was released by WikiLeaks, that it

3

had been edited because there was certain information that wouldn't

4

have been contained in the original such as names of some of the

5

personnel that were casualties in the video.

6

Q.

And you said the WikiLeaks organization, is it a website

7

you said it publishes information?

8

information?

9

A.

What’s the -- How does it publish

The WikiLeaks organization has a website.

The domain name

10

is WikiLeaks.org, or O-R-G, and they also have several other we call

11

them mirror websites that contain generally the same content as the

12

main site.

13

Q.

What do you mean by a, mirror website?

14

A.

When I say mirror I mean that there were additional

15

websites using other domain names that appear to have been hosted

16

physically in other countries or other jurisdictions I guess you

17

could say that would contain the same content as the main site and

18

presumably with the intent so that if the main site was ever taken

19

down by some type of government order or ----

20
21
22

ADC [CPT TOOMAN]:

Objection, Your Honor, this witness would

have no knowledge of why it would be on multiple sites.
MJ:

I’m going to sustain that unless there is a foundation.

8064

11614

1
2

Q.

To your knowledge, Agent Mander, is the WikiLeaks.ORG

website still active?

3

A.

It's still active.

4

Q.

And who can access the website?

5

A.

Any member of the general public.

6

Q.

Who is the public face or leader of WikiLeaks?

7

A.

There is a Mr. Julian Assange is kind of the self-described

8
9

leader or editor of WikiLeaks.
Q.

Agent Mander, I want to talk about the structure of the

10

investigation when it came back to the United States.

11

CCIU, what other investigative organizations were involved in the

12

investigation of PFC Manning?

13

A.

Outside of

Initially the Department of State Diplomatic Security

14

Service or DSS, was involved in investigating the compromise and/or

15

unlawful disclosure of a, I believe it was a diplomatic cable related

16

to information involving Iceland, and that had occurred several

17

months before CID was involved in the investigation.

18
19
20

Q.

And other than the DSS what other organizations were

involved?
A.

Initially when we received information from or should I say

21

that information was developed about a Soldier in Iraq possibly

22

unlawfully disclosing classified information Army military

23

intelligence was also involved because initially there was a concern

8065

11615

1

that possibly foreign intelligence service could be involved as well

2

as the State Department and Army Military Intelligence.

3

Q.

Any federal law enforcement authorities?

4

A.

Later, probably in June, late June or maybe July the FBI

5
6
7
8
9

also became involved.
Q.

What was the status of the investigation or did the various

investigative organizations, were they working together?
A.

Yes, they -- we consider it what we call a joint

investigation and what that means is that the investigative agencies

10

each determine that they will work together and typically they will

11

define kind of investigative leads specific to that agency's interest

12

that they will pursue.

13

Q.

And what was CCIU's lane essentially?

14

A.

CCIU was to investigate all Army and/or DoD related

15

investigative leads.

16

Q.

And what was the FBI's lane?

17

A.

The FBI they would be investigating any civilian leads that

18

didn't really have like a Department of Defense or Army nexus.

19

Q.

Generally did the investigative organizations share

20

information?

21

A.

Yes.

8066

11616

1

Q.

And what about investigative activities, did the various

2

organizations stay in their lane or did they -- did you all do,

3

conduct investigative activities together?

4

A.

Yes.

There's numerous instances such as various interviews

5

that were done jointly.

6

interview that I conducted where there was CID, Army Military

7

Intelligence as well as the DSS agents participated in the interview.

8
9
10
11

Q.

So, for example, there was at least one

And as part of this investigation approximately how many

individuals have you interviewed?
A.

I would have to go back and look at the case file, but I

would say probably at least 25 or more.

12

Q.

And are you familiar with agent’s investigative reports?

13

A.

I'm familiar, yes.

14

Q.

And approximately how many reports have you filed as part

15
16
17
18

of this investigation?
A.

Again, I'd have to review the case file, but I would say

probably, probably in excess of at 50 least.
Q.

I want to talk about some other investigative activity that

19

CCIU conducted in relation to this case.

20

investigation, did CCIU preserve or collect information on the --

21

that was posted on the WikiLeaks website?

22
23

A.

As part of the

At various points I believe there was agents that were

assigned to download information that was published on the WikiLeaks

8067

11617

1

website because it contained classified information and was otherwise

2

evidence.

3
4
5

Q.

And what would be the benefit of collecting information

from there?
A.

How would that -- How was that information used?

The information that was collected from the WikiLeaks

6

website would be used for comparison purposes to information that may

7

be found on digital media that was collected in the case from various

8

places, from various sources.
Q.

Now, is that a typical ----

10

MJ:

Yes.

11

ADC [CPT TOOMAN]:

9

We will object to this line of questioning

12

the witness said that other agents are the ones that downloaded.

13

the witness has no personal knowledge.

14
15

ATC[CPT MORROW]:

Your Honor, I think I've established he has

personal knowledge of the entire investigation.

16

MJ:

Overruled.

17

Q.

Is that a typical investigative activity for CCIU?

18

A.

19

Q.

20

So

What?
Collecting -- Preserving and collecting information from

websites.

21

A.

In some cases, yes.

22

Q.

Now, based on your knowledge and experience, are there ways

23

to observe a website as it appeared on a certain date?

8068

11618

1
2

A.

There are certain tools that would allow you to see what a

website looked like previously.

3

Q.

And what are some of those tools?

4

A.

One tool that we will occasionally use, it's a website that

5

uses the domain name archive.org and it also has a nickname.

6

call it the wayback machine.

7
8
9

Q.

They

And are there any other ways that you might observe a

website as it appeared at a certain date prior?
A.

I know that Google is also a potential source.

Google as

10

it looks at websites to catalog them for search results that

11

sometimes saves a, what we call, a cached version of that website.

12
13
14

Q.

Can you explain how an agent or how would you use Google

cache to see how a website might have appeared on a certain day?
A.

Well, for example, somewhat recently I was searching for

15

particular terms to see if I could find something and sometimes

16

especially DoD computer networks we may be blocked from going to

17

certain websites because of either the nature of the website or

18

sometimes make a key word such as something involving something

19

sexual will be automatically blocked through, you know, Internet

20

filtering.

21

Google cached version and get an idea of what the website that you're

22

looking for looks like.

So to get around this issue sometimes you can look at the

8069

11619

Q.

1

How would you access the Google cache version versus the

2

website that's being blocked?

3

screen when you are accessing the Google cached version?
A.

4

How does it appear to you on the

Generally speaking you would put your search terms into the

5

Google website would you hit search and you would then receive

6

results, and then typically there is -- it depends on what time or

7

era we're talking about, but right now presently there's like a

8

little arrow next to the one of search results and then you can

9

choose to see the cache version versus the actual version.
Q.

10
11

And the cache version, does it indicate that date that the

website was saved or downloaded or?
A.

12

Typically when you view the cached version at the top

13

portion of the version that you'll see it will say something to the

14

effect of, this is Google's version of this website on whatever date

15

and time, and it also will give you a caveat that the website may

16

have changed since then.
Q.

17

And you mentioned the Internet archive or archive.org.

Can

18

you explain how you might use that tool to observe a website in the

19

past?

20

A.

That tool is little more comprehensive and it’s ----

21

Q.

First let's -- Well, let’s start with this then.

22

the Internet archive or what is archive.org?

8070

What is

11620

1

A.

Archive.org is a website that was established.

It seems to

2

be funded by some type of nonprofit organization that their goal is

3

to catalog websites on the Internet, amongst other things.

4

their website does is it appears to periodically go out and download

5

the content of websites and then it saves them for retrieval by the

6

general public that want to use or see what a particular site looked

7

like in the past.

8
9
10
11

Q.

So what

Now, in your experience as an agent, have you used the

Internet archive or archive.org to see how a website might have
looked in the past?
A.

Yes.

There's been occasions where a website involved on an

12

investigation may have been taken down at the time that we want to

13

look at it and thereafter we would like to see when it previously

14

looked like and, therefore, we might use that tool as a way to see

15

what a website looked like in the past.

16

Q.

Okay.

So take me through how you might use the Internet

17

archive or archive.org.

18

try to go through is this slowly.

19

A.

Okay.

Just describe from the beginning and we'll

Assuming that you have a web browser and computer

20

connected to the Internet, you would open up the web browser window,

21

you would navigate to the archive.org website.

22

is a place we can enter in text of what you want to see.

23

would presumably put in the address or uniform resource locator code

8071

On that website there
So you

11621

1

for the websites that you're interested in.

2

search button at which point if the website has been archived or

3

catalogued within archive.org you would be shown something that

4

resembles like a calendar and that calendar will have little circles

5

for days that a capture of the website that you've typed in has been

6

archived at which point you can then click on the little circles and

7

see that version of that website that has been archived.

8
9
10
11

You would then hit a

Q.

And it's -- That version of that website it's linked to a

A.

Yes.

date?
There will be like a date and time sometimes some

websites are catalogued archived more than once per day.

12

Q.

Now, once you've clicked on that date, what happens?

13

A.

Typically the website for the day and/or time that you've

14

clicked on will then display and you will see, generally speaking,

15

what that website looked like on that day and time.

16
17
18

Q.

Now, if you printed that web page from the Internet

archive, what would happen?
A.

If you printed that page you would get a printout of

19

generally what was on the screen, and depending on the browser

20

settings the, most browsers have the ability to, you can include the

21

thing you've printed, the address of the website as well as the date

22

and time and maybe, say, like the number of pages and/or the title of

23

the website.

8072

11622

1
2

ATC[CPT MORROW]:

I'm retrieving what's been marked as

Prosecution Exhibit 109 for Identification.

3

MJ:

Proceed.

4

ATC[CPT MORROW]:

I’m handing the witness ----

5

ADC[CPT TOOMAN]:

Your Honor, the defense requests the

6

opportunity to voir dire this witness about his knowledge of the

7

Wayback machine or archive.org, and how it functions.

8

MJ:

With the goal of preventing admissibility of this exhibit?

9

CDC[MR. COOMBS]:

Yes, Your Honor, voir dire and aid of the

10

objection.

11

this witness and we’d like to voir dire in aid of that objection.

12

MJ:

So, we would object to foundation, personal knowledge of

Let me see the exhibit.

Why don't we do this, again I have

One of them is as the military judge as I would be

13

two roles here.

14

in every case for motions to decide the legality or non-legality of

15

something whether it’s coming in.

16

government at least, at this point, to go forward with the questions

17

on what their foundation would be with respect to admitting this

18

exhibit and then I'll allow the defense a chance to voir dire the

19

witness and decide your objections.

20

defense and not of this exhibit, I won’t consider it.

21

sides?

22

CDC[MR. COOMBS:

23

ATC[CPT MORROW]:

In that role, I will allow the

Should I rule in favor of the

Yes, Your Honor.
Yes, Your Honor.

8073

Fair to both

11623

1
2
3

MJ:

Proceed.

Let me see what that exhibit is first.

Questions continued by the assistant trial counsel [CPT MORROW]:
Q.

I'm handing the witness what's been marked as Prosecution

4

Exhibit 109 for Identification.

5

Agent Mander?

Do you recognize that document,

6

A.

I do.

7

Q.

And what is it?

8

A.

In appears to be a version of the most wanted leaks of 2009

9

list that was obtained from the archive.org website.

10

ATC[CPT MORROW]: Permission to publish to the Court, Your Honor.

11

MJ:

Proceed.

12

[There was a brief pause while the assistant trial counsel published

13

the exhibit to the Court.]

14

Q.

Agent Mander, I want to focus mainly on sort of the bottom

15

of the -- of this page, specifically the line at the very bottom that

16

starts with HTTP://.

Do you see that?

17

A.

Yes, I can see it.

18

Q.

Can you explain just by looking at that line what this web

19

image or what this printout shows or what exactly that means down at

20

the bottom?

21

A.

As I mentioned, when you print a document using your web

22

browser various web browsers will allow you to include in the header

23

or footer of what you're printing information such as the URL of the

8074

11624

1

document you're printing.

2

here, this would be a document that was printed from the address

3

that's listed there that starts with the HTTP://web.archive.org.
Q.

4

So, for example, based on this footer

And what are the numbers, it says / and then a web again.

5

What are the numbers to the right of the -- starting with 2009?

6

does that indicate?
A.

7

What

As far as my knowledge, that would be the date and most

8

likely the time of the capture of the website which follows after the

9

numbers the HTTP://WikiLeaks.org.
Q.

10
11

And, again, what does it say at the end after

WikiLeaks.org?
A.

12

/wiki/draft:the_most and then it looks like the whole URL

13

is too long for the footer so it’s the dots kind of indicate there's

14

more.

15

Q.

Now, as part of this case, Agent Mander, have you had the

16

opportunity to see whether the website still exists even outside of

17

using the archive.org?

18

A.

The WikiLeaks website?

19

Q.

The WikiLeaks website, and specifically the 2009 draft.

20
21
22
23

The website you just looked.
ADC[CPT TOOMAN]:
looked like today.
MJ:

Objection.

Relevance of what WikiLeaks.org

Not relevant, Your Honor.

Where are you going with this?

8075

11625

ATC[CPT MORROW]:

1

Your Honor, between how it looked in the

2

past and how the website still appears today, it can still -- you can

3

still find it on the web today.
MJ:

4
5

You're asking this witness if this witness can find that

document today?

6

ATC[CPT MORROW]:

7

MJ:

Okay.

8

Q.

Agent Mander, please, explain how you would find this

9

Yes, exactly.

That's overruled.

document or this web page today?
A.

10

That particular document I believe I had used some key

11

words and conducted a search using Google, and one of the first or

12

maybe one of the first full results was that document that is

13

actually or was on the WikiLeaks website as of just a couple of weeks

14

ago.

15
16

ATC[CPT MORROW]:

Prosecution Exhibit 110 for Identification.

17

MJ:

18

ADC [CPT TOOMAN]:

19
20

I'm retrieving what’s been marked

Are you going to have similar objections to this one?
May I see it, Your Honor?

Can I have a

moment, Your Honor?
MJ: Yes.

21

[There was a brief pause while the assistant defense counsel

22

retrieved and reviewed the exhibit at counsel table.]

23

ADC [CPT TOOMAN]:

Not at this time, Your Honor.

8076

11626

1
2
3

MJ:

All right.

Questions continued by the assistant trial counsel [CPT MORROW]:
Q.

Agent Mander, I'm handing you what's been marked as

4

Prosecution Exhibit 110 for Identification.

5

please?

6

A.

[Reviewing the exhibit.]

7

Q.

Do you recognize that document?

8

A.

Yes this is a document similar to the one that you just

9
10

showed me.

Can you take a look,

It is the version that you would find on the

WikiLeaks.org website as of June 1st.

11

Q.

And how do you know that?

12

A.

I went to the site and printed out this document and I have

13
14
15

initialed the bottom above the date and time on each page.
Q.

And what did you do -- So, how was that document created?

You printed it?

16

A.

17

ATC[CPT MORROW]:

18
19

I printed it, yes.
Permission to publish to the Court, Your

Honor.
MJ:

Proceed.

20

[There was a brief pause while the assistant trial counsel published

21

the exhibit to the Court.]

22
23

Q.

Agent Mander, how is this web page -- how is this web page

organized?

8077

11627

1

A.

Well generally speaking, it looks like it’s ----

2

Q.

Do you need the exhibit back?

3

A.

Sure.

At the top of the document it says the word

4

draft:themostwantedleaksof2009-sort, and generally speaking below

5

that there is somewhat of like a table of contents which are links,

6

and each of the links represents the various countries in

7

alphabetical

8

international organizations.

9

countries and below each country appears to be a list of documents or

10

order to include like a miscellaneous category of
And then below that are listed various

other information.

11

Q.

Does the United States appear on that list?

12

A.

The United States does appear on this list.

13

Q.

And what page is that?

14

A

It begins on Page 9 and appears to go to Page 11.

15

ATC[CPT MORROW]:

16
17

Your Honor, permission to publish Page 9 to

the Court.
MJ:

Proceed.

18

[There was a brief pause while the assistant trial counsel published

19

the exhibit to the Court.]

20

Questions continued by the assistant trial counsel [CPT MORROW]:

21
22
23

Q.

Agent Mander, at this time, I'd like you to move to the

panel box, please, if you would?
A.

What's the panel box?

8078

11628

Q.

1
2
3
4
5
6

Right here.

You can just leave the exhibit back.

Thank

you.
ATC[CPT MORROW]:

I'm handing Agent Mander what's been

admitted as Prosecution 81.
Q.

Mr. Mander, Agent Mander, I'd like you to scroll down to 28

November in that exhibit.

7

A.

Okay.

8

Q.

And I’d like you to look at lines 27 through 33.

9

A.

Okay.

10

Q.

What are lines 27 to 23 -- or 33, what do they say?

11

A.

The whole line or just the action column?

12

Q.

The action line, please.

13

A.

From line 27 the action column reads,

14

‘retention+of+interrogation+videos’.

15

Q.

16

information?

17

A.

Can you move up to the top of the document?

18

Q.

Let me help you.

19

Do you see anything under Military

Intelligence?

20

A.

21

videos.

22

Q.

23

On this list found on this website, do you see any similar

On the second bullet there's a CI detainee interrogation
That appears there.
And, again, like for you to scroll to, in that exhibit that

you are looking at.

Scroll to lines 114 and 115, please.

8079

11629

1

A.

Okay.

2

Q.

What do you see?

3

information?

4

A.

5
6
7

What's the action there?

What's the

Line 114 it reads, ‘interrogation+tapes’ and line 115 it

reads, ‘interrogation+video’.
Q.

Agent Mander, now, I'd like to go back to 29 November,

please and lines 43 and 44 specifically.

8

A.

Okay.

9

Q.

And have you found that?

10

A.

I have.

11

Q.

And what are the lines -- what do those read?

12

A.

The action column it reads, ‘detainee+abuse’ and that's for

13
14
15
16
17

line 43, line 44 is the same, ‘detainee+abuse’.
Q.

And does similar information exist under the Military

Intelligence section of this web page?
A.

On the fourth bullet the words, ‘detainee abuse photos

withheld by the Obama administration’.

18

Q.

Now, I'd like to go to 30 November in line 62.

19

A.

Okay.

20

Q.

And what does that line read?

21

A.

The action column also reads, ‘detainee+abuse’.

8080

11630

Q.

1

Now, I want you to go to a serious of searches starting on

2

8 December.

3

lines 100 through 111.
A.

4
5

8
9

Line 100, the action column reads,

‘Guantanamo+detainee+operations’.

6
7

I'm looking specifically at -- if you could refer to

Q.

Okay.

Just keep reading.

Just read all of them down to

A.

The next line, ‘JTF+G-T-M-O’ GTMO.

111.

‘JTF+GTMO’, excuse me ‘G-T-M-O+SOP’.

The next line is,

Next line is C-J-T-

10

F+82+detainee+ SOP’.

11

+82+detainee++operations’.

12

O+SOP+interrogation’.

13

The next line is, ‘J-T-F+G-T-M-O+SOP+interrogation’.

14

is, ‘SOP+interrogation’.

15

next line is, ‘J-T-F+G-T-M-O+SOP’.

16

O+Delta+SOP’.

17
18
19
20
21
22

Q.

Next line is ‘C-J-A-T-FNext line is, ‘J-T-F+G-T-M-

Next line is, ‘C-G’, excuse me, ‘C-J-T-F+101’.
The next line

The next line is, ‘J-T-F+G-T-M-O’.

The

The next line is, ‘J-T-F+G-T-M-

The next line is, ‘human+rights+campaign’.

Okay.

First what's SOP mean to you as somebody who's been

in the military?
A.

Generally that's an abbreviation for an acronym for

standard operating procedure.
Q.

And what does Delta mean to you in the context of these

searches?

8081

11631

1
2
3

A.

I would assume that would be Camp Delta, which is a portion

of Guantanamo Bay and the detainee facility there.
Q.

Now, those lines 100 through 111, is any similar
I'll give you a

4

information or items appear in this list here?

5

moment. I would ask you just to review all the way down.

6

see something that catches your eye, please, let me know.

7

A.

[Reviewing the document.]

When you

On the, I believe it’s the

8

seventh bullet use the word Camp Delta (Guantanamo) standard

9

operating procedures, excuse me procedure 2005/2009.

Two bullets

10

below that is the words, ‘unredacted inquiry into treatment of

11

detainees in U.S. custody 20 November 2008’.

12

that is the words Camp Delta (Guantanamo standard operating procedure

13

2005-2009’, below that is Camp Delta (Guantanamo interrogation

14

standard operating procedure 2003-2009, and that appears to be all

15

what I see.

16

ATC[CPT MORROW]:

A few bullets below

Your Honor, at this time the prosecution

17

moves to admit Prosecution Exhibits 109 and 110 into evidence as

18

Prosecution Exhibit 109 and 110.

19
20

MJ:

All right.

Well, I'm going to allow the defense to voir

dire witness before ----

21

ATC[CPT MORROW]:

22

MJ:

Sure, of course.

---- we do that.

Are you finished?

8082

11632

1

ATC[CPT MORROW]:

No, no, I'm not, actually.

I’m sorry.

I

2

have a few more questions to go through regarding different exhibits

3

but I can stop now, if you like.

4

MJ:

Why don't we stop now?

I'll let the defense voir dire and

5

we'll concentrate on those exhibits.

6

order and then we'll call -- we’ll resolve that issue and then we’ll

7

go forward with the rest of your direct.

8
9
10
11
12
13
14
15
16
17
18
19

ATC[CPT MORROW]:

I'm replacing Page 9 in Prosecution Exhibit

for ID 110.
MJ:

Now, does the witness need to remain there or can the

witness come back to the chair?
ATC[CPT MORROW]:

The witness can go back to the chair, Your

Honor.
MJ:

All right.

[The witness resumed his seat at the witness stand.]
ADC [CPT TOOMAN]: We would object to Prosecution Exhibit 110 as
hearsay.
TC[MAJ FEIN]:

Ma’am, the United States is retrieving

Prosecution Exhibit 81 from the witness.

20

MJ:

21

ATC[CPT MORROW]:

22

We’ll go a little bit out of

Okay.
I'm handing the court reporter Prosecution

Exhibit 110 for ID.

23

8083

11633

VOIR DIRE EXAMINATION

1
2

Questions by the assistant defense counsel [CPT TOOMAN]:
Q.

3

Agent Mander, I want to talk to you a little bit about

4

archive.org, Wayback machine.

5

Identification.

6

you?

Prosecution Exhibit 109 for

You didn't actually visit WikiLeaks.org in 2009, did

7

A.

No, not in 2009.

8

Q.

So you didn't actually see what their website looked like

9

in 2009?

10

A.

In 2009 I did not actually go to the website and see it.

11

Q.

And with archive.org what you see is what they tell you was

12
13
14
15
16
17
18

there, you didn't actually see what was there in 2009?
A.

If I go to archive.org I see what is presented for the date

that they say that it was there.
Q.

Okay.

You don't have any knowledge of how archive.org

actually compiles their data, do you?
A.

I do not.

I have various, I guess, you can say,

assumptions of how it works based on my knowledge in the field.

19

Q.

But you don't know where that data comes from?

20

A.

Which data?

21

Q.

The data that's on archive.org.

22

A.

I would assume that it comes from the sites that are

23

presented that they archive.

8084

11634

1
2

Q.

So you don't know where it comes from?

You don't know how

the data is gathered?

3

A.

Technically, no, I don't know how that data is gathered.

4

Q.

You don't know how often that data is gathered?

5
6

You don't

know the frequency of that data gathering?
A.

I can say that the frequency appears to be just periodic.

7

It doesn't seem to have a set schedule just based on the results that

8

are available.

9
10

Q.

And you don't know if that's all of the data because you

didn't actually go to the website in 2009, correct?

11

A.

The website?

12

Q.

So in this case we're talking about the WikiLeaks most

13

wanted list.

14

looking at it on archive.org, you don't know if anything is missing,

15

correct?

You didn't actually go to it in 2009, so when you are

16

A.

That would be a fair statement.

17

Q.

Now, you mentioned on direct that when you go to

18

archive.org there are some days that are missing.

19

that is?

20
21
22
23

A.

Do you know why

I don't believe that I said that there were some days that

were missing.
Q.

I think you said that the calendar would come up and you

can click on a day and then if you had the ability to click on the

8085

11635

1

day that means that archive.org is saying that we have a website for

2

that day, but I would imagine you can't click on every day, can you?

3

A.

You cannot.

4

Q.

So there are days missing?

5

A.

There are days when the archive.org website does not appear

6
7

to have archived that website.
Q.

Okay.

Do you have any knowledge of whether or not a

8

website could embed code to their website that would prevent

9

archive.org from gathering their website?

10

A.

I believe there is a file that web host or web masters can

11

put on their site called robot.text, and other archiving type sites

12

are supposed to respect that file, and in that file you can put in

13

certain key words I believe that be tell other sites, not to archive

14

or save copies of your file or your website.

15

Q.

Do you know where the archive.org servers are located?

16

A.

I have no direct knowledge of that.

17

Q.

Do you know when archive.org gathers their information?

18

A.

You mean like time of day?

19

Q.

Time of day?

20

A.

Based on the results that are displayed on their website

21

for various given sites it appears to be just periodic.

22

doesn't appear to be any particular time of day, day, day of week, or

23

any other pattern that I can discern.

8086

There

11636

1
2
3
4
5
6
7
8
9
10

Q.

Are you aware of whether or not are there have ever been

any hack attempts on the cache servers employed by archive.org?
A.

I do not have any direct knowledge, but I would be

surprised if there were not any hacks.
Q.

Do you have any knowledge of the operating system that the

servers are running?
A.

I do not have knowledge of what operating systems they're

running.
Q.

Do you have any knowledge as to whether or not there are

backups of servers?

11

A.

I do not have any direct knowledge of that.

12

Q.

Were you actually there when the particular website you

13

were talking about today, were you there when it was cached by

14

archive.org?

15

A.

Was I -- when you say there?

16

Q.

Were you actually there when whoever from archive.org

17

gathered what they say was this website, were you actually there when

18

they did it?

19

A.

20
21
22

I was not at archive.org wherever their location is when

that was archived.
Q.

You talked a little bit about a robot.text file that a site

could put on -- that a company could or a person could put on their

8087

11637

1

website.

Do you have any knowledge of whether or not WikiLeaks had

2

one of those on their website?

3

A.

I do not have any knowledge of that.

4

ADC [CPT TOOMAN]:

One moment, Your Honor, please.

Your Honor,

5

we have no further voir dire questions of this witness.

6

objection to Prosecution Exhibit 109 for Identification because this

7

witness has no personal knowledge of how archive.org operates.

8

are a number of cases that have considered the admissibility of

9

archive.org.

10

MJ:

11

ADC [CPT TOOMAN]:

12

MJ:

13

ADC [CPT TOOMAN]:

We would

There

And you plan to present those to me when?
Right now, Your Honor.

Thank you.
I will note first that none of those cases

14

are criminal cases, they all are civil cases dealing with either

15

trademark or paten law.

16

pronunciation.

17

MJ:

One of them is Telawizja, and Pardon my

Why don't we do this:

You can read them on the record, but

18

if you're going to present me cases, I am going to have a Xerox copy

19

of them, right?

20

ADC [CPT TOOMAN]:

21

MJ:

Yes, ma'am.

Okay.

8088

11638

1

ADC[CPT TOOMAN]:

One of them

is, this is a Polish

2

pronunciation so I will butcher it, Telawizja Polska v. EchoStar,

3

would you like the cite, Your Honor?

4

MJ:

Yes, please.

5

ADC [CPT TOOMAN]:

It's 2004, Westlaw WL2367740.

In that case

6

the Court required an affidavit from the wayback machine from the

7

proprietors of the wayback machine before they would allow

8

admissibility and also St. Luke's Cataract cite 2006, Westlaw 130242.

9

In that case the Court precluded the admissibility of the wayback

10

machine absent testimony from someone with personal knowledge.

11

so, in that case the Court wanted actually someone from WikiLeaks.

12

In this case they would want someone from WikiLeaks to come and talk

13

about what was actually on their website at the time.

14

objection to Prosecution Exhibit 109 for Identification would be

15

authentication as well as double hearsay, and we will, of course, get

16

you those cases, Your Honor.

17

MJ:

18

hearsay?

And

So our

Thank you, and your objection to Prosecution Exhibit 110 is

19

ADC [CPT TOOMAN]:

20

MJ:

21

ATC[CPT MORROW]:

Okay.

Yes, ma'am.

Government, do you have any case authority for me?
The government believes there are some more

22

recent cases, Your Honor, that would shed light on the issue with

23

respect to the double hearsay issue.

8089

I don't think it's a double

11639

1

hearsay issue.

2

battle site printout that was a representation of the archive.org

3

website capturing another website.
MJ:

4
5

ATC[CPT MORROW]:

10

No, Your Honor.

We're offering both

exhibits for its impact on the listener.
MJ:

8
9

So are you offering it for the truth of the matter asserted

or not?

6
7

Agent Mander's testimony was very clear that is a

overruled.

Okay.

The hearsay objection to Prosecution Exhibit 110, is

So if there is not any other objections to Prosecution

Exhibit 110 I'll admit that.
ADC [CPT TOOMAN]:

11

Your Honor, we would also object based on

12

relevance.

There is absolutely no evidence that PFC Manning actually

13

ever saw this particular website.

14

believes it is not relevant.

15

MJ:

16

ATC[CPT MORROW]:

So absent that the defense

What’s the relevance?
Your Honor, I believe Agent Mander used

17

Prosecution Exhibit 81 to go through and provide circumstantial

18

evidence through his testimony of the user of those computers

19

searching for information very similar to information of the similar

20

site.

21
22

MJ:

What's the difference between Prosecution Exhibit for

Identification 109 and 110?

8090

11640

1

ADC[CPT TOOMAN]:

There's no difference, Your

2

fact, we would, we can leave the issue alone.

3

Exhibit 110 is admitted.

4

MJ: Wait a minute, let's go back.

5

I know you have to go.

6

can ask him some questions right now.

7

ADC[CPT TOOMAN]:

8

MJ:

9
10

Honor.

In

If the -- Prosecution

Prosecution Exhibit 1 -- And

Just remind myself of the witness, maybe I

Yes.

Prosecution Exhibit 110, what is it and what did you do to

get it?
WIT: Can I see the two exhibits?

To answer your question,

11

ma'am, I believe the one exhibit is directly from the WikiLeaks

12

website which was recently within the last couple of weeks and the

13

other version is the archive.org version of the same document as

14

captured, reportedly captured in, well, reportedly captured in 2009

15

by the archive.org website.

16

MJ:

So, with Prosecution Exhibit 110, was your testimony that

17

you basically Googled the WikiLeaks website and there that document

18

was and you printed it.

19

WIT: How can I tell which one’s ----

20

ATC[CPT MORROW]:

21

The numbers are on the bottom ---- Agent

Mander, if you refer to the one you printed yourself ----

22

WIT: And initialed?

23

ATC[CPT MORROW]:

Yes.

8091

11641

1

WIT: I’m sorry, ma’am.

2

MJ:

3

That’s okay.

So the one he printed himself is Prosecution

Exhibit 110, right?

4

ATC[CPT MORROW]: Yes, ma'am.

5

MJ:

6
7
8
9

So, tell me how you got Prosecution Exhibit 110, what did

you do?
WIT: I went directly to the

WikiLeaks.org website and printed

out the document that I had on my screen.
ADC[CPT TOOMAN]:

Your Honor, just with respect to

10

Prosecution Exhibit 110 for Identification, we would renew the

11

relevance objection based on the fact that this was, I think, the

12

date on that it's 1 June.

13

MJ:

Again, I'm going to overrule that.

That's the date of 1

14

June, the document itself has a different date in it that is in the

15

document that's on the website.

16

weight, not admissibility.

17

ADC [CPT TOOMAN]:

Okay.

So what you’re arguing is going to

Your Honor, we just think that the

18

date of 2009, there's no proof or no evidence that that was actually

19

up on the website in 2009 nor is there evidence that PFC Manning

20

actually saw in it in 2009.

21

MJ:

I understand all of that.

22

ADC[CPT TOOMAN]:

Thank you, Your Honor.

8092

11642

1

MJ:

Now, with respect to Prosecution Exhibit 109, I will take

2

that under advisement.

I will consider the authority offered by both

3

sides and make a ruling probably tomorrow morning.

4

ADC[CPT TOOMAN]:

Yes, ma'am.

5

ATC[CPT MORROW]:

Yes, Your Honor.

6

MJ:

7

ATC[CPT MORROW]:

8
9

And do you have cases to give me as well?

we do.
MJ:

In hard copy?

10

ATC[CPT MORROW]:

11

MJ:

12
13
14

All right.

Yes, Your Honor.
Depending on how voluminous this authority is,

my ruling may not come tomorrow morning, but it will be coming.
ATC[CPT MORROW]:

I'm retrieving Prosecution Exhibit 110 and

Prosecution Exhibit 109 for Identification from the witness.

15

MJ:

16

ATC[CPT MORROW]:

17

MJ:

Can I see Prosecution Exhibit 110?
Yes, ma’am.

Prosecution Exhibit 110 is admitted.
DIRECT EXAMINATION (continued)

18
19

We have several cases that we have -- yes,

Questions by the assistant trial counsel [CPT MORROW]:

20

Q.

Agent Mander, are you familiar with the term, social media?

21

A.

Yes, I am.

22

Q.

And what is social media?

8093

11643

1

A.

Generally the term, social media, refers to either websites

2

and/or systems that encourage members of the general public to create

3

accounts and then encourages them to communicate with each other.

4

Q.

And what are some examples of social media websites?

5

A.

Some examples might include the website Facebook, the

6

website MySpace as well as Twitter as an example.

7

Q.

And what is Twitter?

8

A.

Twitter is both a website as well as I guess you can

9

consider it software that runs in various platforms that allows

10

members of the general public to submit short messages which other

11

members of the general public can then follow or subscribe to.

12
13

Q.

During the course of an investigation, do you recall having

seen a WikiLeaks organization Twitter feed?

14

A.

Yes, the WikiLeaks organization has a Twitter account.

15

Q.

And what is the user name or handle of that account?

16

A.

I believe it's just WikiLeaks.

17

Q.

And generally why do people use Twitter?

18
19

What's the

purpose of it?
A.

Personally I would say for entertainment, however, you

20

could also use it as a method to disseminate information generally

21

widely to the public.

8094

11644

1

Q.

And how is Twitter set up?

You know, my understanding of

2

Facebook is, you know, you have friends and those friends can see

3

your Facebook website.

4

A.

How is Twitter set up?

Twitter is generally set up in that any member of the

5

general public can create an account in which they can then post

6

short messages.

7

those messages by searching for that user or their website or they

8

can subscribe to that user's Twitter feed which is a long running

9

collection of messages directly and then presumably they get those

10

messages in real time, or near real time, as they are submitted to

11

the system or the site.

12
13

Q.

Other members of the general public can either view

And WikiLeaks Twitter feed you referred to earlier the

Twitter account is that accessible on the Internet?

14

A.

It is accessible by the general public on the Internet.

15

Q.

And you said there's a feed, what do you mean by, a feed?

16
17

Just that explain that again, please.
A.

I would describe the Twitter feeds is basically a

18

collection of the messages that have been submitted by a particular

19

user account and they appear generally in chronological order with

20

the most recent message at the top of the feed.

21

Q.

And have you observed the WikiLeaks Twitter feed recently?

22

A.

Somewhat recently, yes.

23

Q.

And how active is that feed?

8095

11645

1
2

A.

It appears to be very active.

There were messages about

when I last saw it about this trial occurring.

3

MJ:

When was that?

4

WIT: I believe that was also ----

5

ADC [CPT TOOMAN]:

Objection, Your Honor, relevance.

The

6

recent feeds of WikiLeaks don’t go to any element of the charges

7

against PFC Manning.

8

MJ:

9

WIT: It was sometime after the beginning of the Manning trial.

10

Tell me the last time you accessed it was.

So, maybe the 3rd or 4th of June of this year.

11

MJ:

12

ATC[CPT MORROW]:

13
14

What is relevant that you are trying to establish?
I'm just laying a foundation of the witness'

knowledge of the Twitter feed that's all, Your Honor.
MJ:

That's all I'll consider it for.

Okay.

Go ahead.

Before

15

you continue your testimony was that software that runs on various

16

platforms, what is a platform?

17
18
19
20

WIT: A platform could be considered a computer, a smart phone,
tablet, different types of computer hardware, Your Honor.
MJ:

Thank you.
[END OF PAGE]

21

8096

11646

1
2

Questions continued by the assistant trial counsel [CPT MORROW]:
Q.

Now, have you reviewed -- when you recently reviewed the

3

Twitter feed, the WikiLeaks Twitter feed, could you tell whether

4

there had been Tweets or were the Tweets from you know several years

5

ago still available to you?

6
7
8
9

A.

It appears that all of the publicly published messages from

any given account are -- remain on the site indefinitely.
Q.

And we talked about the Internet archive previously.

do you have to use the WikiLeaks or have you had to use the Internet

10

archive to access Tweets from the past in this feed or are those

11

Tweets still available?

12

Now,

A.

When I attempted to look at Twitter messages on Internet

13

archive I received a message saying that those were unavailable, and

14

I generally assumed because of the volume of messages that are in

15

archive does not archive or catalog those.

16
17
18

ATC[CPT MORROW]:
Identification.
Q.

I’m retrieving Prosecution Exhibit 32 for

I'm showing it to defense counsel.

Agent Mander, I'd like you to ignore the second of page on

19

this exhibit.

20

that document?

If you would -- Would you please -- Do you recognize

21

A.

Yes, I do.

22

Q.

And what is it?

8097

11647

1
2
3
4
5

A.

This is a printout of the Google's cached version of a

Twitter message sent on the WikiLeaks Twitter account.
Q.

And, again, what's the Google -- When you say it's the

Google cached version, what do you mean by that?
A.

It is the version that Google saves as a search result that

6

you can use to view a particular website if for some reason that

7

website is maybe unavailable directly.

8
9

Q.

the WikiLeaks Twitter feed?

10

A.

11

Q.

12
13
14

Now, do you have to use the Google cache version to access

You do not.
Let's talk about that specific printout.

Is the Tweet

dated?
A.

The message is dated.

It's dated, 8 or possibly 6 January

of 2010.

15

ATC[CPT MORROW]:

16

MJ:

Your permission to publish to the Court.

Go ahead.

17

[There was a brief pause while the assistant trial counsel published

18

the exhibit for the Court.]

19

Q.

That's kind of hard to see, Agent Mander, but I want to

20

talk about some of the sort of graphics behind the message.

21

seen -- first, can you describe sort of that graphic?

22
23

A.

Have you

The background graphic appears to be repeated four times

horizontally.

It appears to be I guess you could describe it as two

8098

11648

1

globes that are in an hour glass and they appear to be -- the top

2

upper most one appears to be dripping to the lower one.

3

Q.

And have you seen that graphic like that before?

4

A.

That appears to be the logo or graphic that is typically

5
6
7
8
9

permanently displayed on the WikiLeaks website.
Q.

Now, Agent Mander, you said this is a representation of

something you printed, or explain exactly what this is again, please?
A.

Sometimes we take what we call a screen capture which is a

-- we can use various types of software to actually take I guess what

10

you could call a picture of the computer screen, the monitor,

11

whatever we're looking at, and then save it as a graphics file.

12

you'll actually see in the bottom right-hand corner some of the

13

information from my computer as well as what other windows I had

14

opened down in the bottom.

15

it's there.

16
17
18

Q.
web page?
A.

So

That's kind of hard to see from this, but

And did you -- what do you after you observed this on the
What did you do?
I believe I took a screen capture of the, you know, what I

19

was looking at and this item was printed out and -- can you move it

20

up so I can see the ----

21

Q.

Sure.

8099

11649

1

A.

---- very bottom?

On the very bottom is the time and date

2

of when this item was printed, and then those are my initials that I

3

actually put on the printed page.

4

ATC[CPT MORROW]:

Your Honor, the prosecution offers

5

Prosecution Exhibit 32 for Identification into evidence as

6

Prosecution Exhibit 32.

7

ADC [CPT TOOMAN]:

We will object, Your Honor.

Again, personal

8

knowledge.

9

Tweet on the date reported to be and also relevance because, again,

The witness used a web cache.

Didn't actually view the

10

not viewed on -- I guess viewed on 1 June so it wouldn’t be relevant

11

and I guess again personal knowledge of how Google ----

12
13

MJ:

Do you want to voir dire the witness with respect to his

personal knowledge on Google cache?

14

ADC [CPT TOOMAN]:

I would like to, yes, Your Honor.

15

ATC[CPT MORROW]:

May I ask a few questions first, Your Honor?

16

MJ:

17
18
19
20

Yes, go ahead and finish and then you can go.

Questions continued by the assistant trial counsel [CPT MORROW]:
Q.

With respect to this Tweet specifically, did you read the

Tweet?
A.

The message that is Tweeted is, ‘have encrypted videos of

21

U.S. bomb strikes on civilians http://bit.ly/wlafghan2.

22

super computer time, Http://ljsf.org/’.

23

Q.

Again, what -- when is that Tweet dated?

8100

We need

11650

1

A.

It appears to be either 6 or 8 January of 2010.

2

Q.

And have you seen that Tweet before in another context

3

other than the Google cache?

4

A.

This Tweet is also on the WikiLeaks Twitter account.

5

Q.

So how would you find that Tweet on the WikiLeaks Twitter

6
7

account?
A.

One of two ways.

You could either do a search for it using

8

something like Google and then go directly to the Twitter page that

9

has that message or you could go to Twitter look for the WikiLeaks

10

account and then presumably scroll through all of their messages

11

until you found this particular one.

12

Q.

And have you done that as part of this case?

13

A.

I did the first mentioned way.

14

thousands of Twitter messages.

So I did not read every single one.

15

Q.

But you read this one?

16

A.

Yes, I saw this one.

17

Q.

And you printed this one?

18

A.

I did.

19

Q.

Do you recall when that was?

20

A.

That was sometime ago.

21

ATC[CPT MORROW]:

22
23

That was maybe last year.

I'm retrieving the exhibit from the witness.

MJ: Are you finished?
ATC[CPT MORROW]:

There was I believe like

Yes, Your Honor.

8101

11651

1

MJ:

2

ATC[CPT MORROW]:

3

MJ: So, you have more coming?

4

ATC[CPT MORROW]:

5

MJ:

6

ADC [CPT TOOMAN]:

7

MJ:

8

All right.
With respect to that Tweet.

I have more one Tweet coming.

All right.

All right.

get your chance.

Are you anticipating the same objection?

Why don't we just go through it and then you'll

Go ahead.

ATC[CPT MORROW]:

9

We would, yes, Your Honor.

I'm retrieving Prosecution Exhibit 31 for

10

Identification from the court reporter.

I'm handing the witness

11

what's been marked as Prosecution Exhibit 31 for Identification.

12

Questions continued by the assistant trial counsel [CPT MORROW]:

13

Q.

Agent Mander, do you recognize that document?

14

A.

Yes, I do.

15

Q.

And what is it, and, again just concentrate on the first

A.

This document is a screen capture showing another Tweet

16
17
18

page?

from a WikiLeaks website as cached by Google.

19

Q.

And what date is that Tweet?

20

A.

The date of the Tweet is 7 May 2010.

21

Q.

And what's the content of the message?

8102

11652

1

A.

The message reads, ‘We would like a list of as many .mil e-

2

mail addresses as possible.

3

submit’.

4
5

Q.

Please contact editor@WikiLeaks.org or

And you viewed this Tweet using Google cache on your

computer?

6

A.

I did.

7

Q.

And what did you do after you observed the Tweet?

8

A.

I took a screen capture and then printed out that screen

9
10
11

capture, and initialed the printed page that it was printed out.
Q.

And did you do that at the same time as the other Tweet we

just talked about?

12

A.

Roughly at the same time.

13

Q.

Approximately?

14

A.

Yes.

15

Q.

And with respect to Prosecution Exhibit 31 for ID, you

16

talked -- we previously talked about the background.

17

it back to you.

18

have you seen those -- that background text and graphics?

19

A.

I'll just hand

The background text, the graphics, and, again, where

The background graphics appear to be identical to the other

20

Tweet, and I've seen the same similar graphic on the WikiLeaks.org

21

website.

22
23

Q.

Have you seen that message before in the WikiLeaks Twitter

feed, not in a Google cache form?

8103

11653

1
2
3
4

A.

Yes.

It's still available on the actual Twitter account of

their feed from the WikiLeaks Twitter account.
Q.

When did you see that Tweet in the regular WikiLeaks

Twitter feed?

5

A.

That was sometime ago, and I don't remember the exact date.

6

Q.

Was it approximately the same date as you the saw the other

7

Tweet?

8

A.

Yes.

9

Q.

And, again, what did you do at that time with that Tweet?

10

A.

Essentially something similar, took a screen capture or

11
12

printed the Tweet onto paper and then initialed that piece of paper.
ATC[CPT MORROW]:

I'm retrieving Prosecution Exhibit 31 for

13

Identification and handing it to the court reporter.

14

would move to admit this exhibit for Identification as well.

15

MJ:

16

ADC [CPT TOOMAN]:

17

MJ:

18
19

All right.

Okay.

Your Honor, we

I assume the same objection?
Yes, ma'am.

And what is your objection to Prosecution Exhibits

31 and 32?
ADC [CPT TOOMAN]:

Your Honor, we would object on hearsay.

We

20

would also object that the witness has no personal knowledge, can't

21

authenticate them.

22

cache.

No personal knowledge of how Google creates their

8104

11654

1

MJ:

If I'm understanding the government's position, they're not

2

offering it to admit on that basis, they're offering to admit it on

3

the prior or both, what are you doing?

4

ATC[CPT MORROW]: Your Honor, we actually have the prior version

5

printed and that was produced in discovery as well.

6

didn't ----

7

MJ:

8

ATC[CPT MORROW]:

9

MJ:

10
11

On what basis are you moving to admit these?

ATC[CPT MORROW]:

We are not offering either exhibit for the

truth.
MJ:

13

ATC[CPT MORROW]:

14

Manning.

15

MJ:

17

Excuse me?

On which basis are you moving to admit these two exhibits?

12

16

The reason we

I understand that.
We're offering it for its effect on PFC

Are you offering the Google cache or are you offering the

prior look?
ATC[CPT MORROW]:

We're offering the prior look and we'll

18

actually add that as an Exhibit Alpha to these exhibits.

The reason

19

that we didn't have them on this date is that when we printed it's

20

very hard to see the date of the Tweet.

21

version to insert, or to mark as an exhibit so that the date could be

22

readable.

So we used this color

We can -- we will certainly -- can attach or mark the

8105

11655

1

other version that Agent Mander has printed and initialed as well and

2

add that to the record.

3

MJ:

All right.

Go ahead Captain Tooman.

4

ADC[CPT TOOMAN]:

VOIR DIRE EXAMINATION

5
6
7
8

Thank you, ma’am.

Questions by the assistant defense counsel [CPT TOOMAN]:
Q.

Just a few questions for you about your knowledge of Google

cache and Twitter.

Do you personally have a Twitter account?

9

A.

I do not.

10

Q.

Do you have any knowledge of how Twitter archives their

11

messages?

12

A.

When you say knowledge, can you be more specific?

13

Q.

Do you know how they do it?

14

A.

I don't know.

15

Q.

Do you know the process they go through in order to save

16

Tweets?

17

A.

No.

18

Q.

Do you know if a Tweet can be deleted?

19

A.

I do not know for certain, no.

20

MJ:

Yes?

21

ATC[CPT MORROW]:

22

Your Honor, if it would help the Court we

are simply offering this for what it purports to be which is simply a

8106

11656

1

printout of a web page.

2

necessarily relevant.

So his knowledge of Twitter is not

3

MJ:

I'm going to overrule that. Go ahead.

4

Q.

Agent Mander, I want to talk to you about Google cache.

5

Do

you know how Google goes about creating their cache?

6

A.

Specifically the technical aspects, no.

7

Q.

Do you know where their servers are located?

8

A.

I believe they have servers located in many places.

9

Q.

Do you know where the servers are located that service the

10

cache?

11

A.

I do not.

12

Q.

Do you know how often Google goes out and creates their

13

cache, how often they go out and grab data?

14

A.

I do not.

15

Q.

And do you know if they use a program or a proprietary

16

algorithm in order to grab that information?

17

A.

I would assume, yes, they do.

18

Q.

You assume that, but do you actually know?

19

A.

I do not.

20

Q.

Do you know the frequency with which Google goes out and

21
22

grabs information?
A.

I do not.

8107

11657

1
2

Q.

Do you know if there's any way that a web page could

prevent Google from grabbing it?

3

A.

I believe the robot.text file that we talked about before

4

is a method.

5

Q.

And as you answered before when we were talking about

6

archive.org, do you also not know whether or not WikiLeaks.org

7

employs one of those robot.text files?

8

A.

I do not know if they employ one of those files.

9

Q.

Now, there were a couple of dates on these Tweets that were

10

hard to read.

Did you ever actually look at Twitter on those dates?

11

So 6 January or 8 January 2010, did you

look at Twitter on that day?

12

A.

I did not.

13

Q.

Do you know if the Google cache servers have ever been

14

hacked?

15

A.

I do not know that.

16

Q.

Do you know if anyone has ever tried?

17

A.

I do not know that.

18

Q.

Do you know the operating system that Google cache runs?

19

A.

I do not know that.

20

Q.

Do you know if they have backups of their servers?

21

A.

I have no actual knowledge of that, no.

22

ADC [CPT TOOMAN]:

23

Thank you Agent Mander.

Your Honor, we

would renew our objections authentication for Prosecution Exhibit 31

8108

11658

1

for Identification and 32 for Identification as well as is hearsay,

2

Your Honor, and we'll address the other versions I guess ----

3
4

MJ:

I believe the government told me that they're offering it

for nonhearsay purposes.

5

ATC[CPT MORROW]:

6

MJ:

7

ATC[CPT MORROW]:

Is that correct?
We are, Your Honor.

What is that?
With respect to the 7 May Tweet we're

8

offering it for -- offering the Tweet for its effect on the listener.

9

7 May 2010, that is the .mil e-mail addresses.

10
11

MJ:

Okay.

I'm sorry, I interrupted you.

hearsay with respect to Prosecution Exhibits 31 and 32, right?

12

ADC [CPT TOOMAN]:

13

MJ:

14

that one was?

15

ADC [CPT TOOMAN]:
as relevance.

17

MJ:

21

109 would be the same, Your Honor, as well

Do you have any redirect?
REDIRECT EXAMINATION

18

20

Yes, ma’am.

And Prosecution Exhibit 109 you have -- your objection to

16

19

Authentication and

Questions by the assistant trial counsel [CPT MORROW]:
Q.

Agent Mander, well, just a couple of questions.

Do you know

how to use the Internet?

22

A.

Yes.

23

Q.

Do you know how to navigate to a web page on the Internet?

8109

11659

1

A.

2

Q.

3

Yes.
And in this case have you navigated to web pages on the

Internet?

4

A.

I have.

5

Q.

And give me a couple of examples of web pages you've

6
7

navigated to on the Internet that’s part of this investigation?
A.

The WikiLeaks website, the Facebook profile of PFC Manning,

8

the Twitter messages that we've discussed as well as the archived

9

versions of various other sites.

Need more examples?

10

Q.

No, I think that's enough.

11

MJ:

All right, temporary excusal for this witness or permanent

12

excusa’.

13
14

ADC [CPT TOOMAN]:

MJ:

16

ADC [CPT TOOMAN]:

17

MJ:

19
20
21
22
23

I’m sorry, Your Honor, at least I was

personally under the impression that I just voir dired the witness.

15

18

Thank you.

You have further cross-examination?

Okay.

Yes, ma'am.

I didn't realize that.

I guess you're still on your

direct examination.
ATC[CPT MORROW]:

I am, so I guess I'm looking for my direct,

so give me a second.
MJ:

Would the this been a good time to recess the Court for

about 10 minutes.
ATC[CPT MORROW]:

Absolutely, Your Honor.

8110

11660

1

ADC [CPT TOOMAN]:

2

MJ:

3

ATC[CPT MORROW]:

Yes, ma'am.

4

ADC[CPT TOOMAN]:

Yes, ma'am.

5

MJ:

All right.

No objection, Your Honor.

Is 10 minutes enough?

All right.

The Court is in recess until 1715.

Agent

6

Mander, please don’t discuss your testimony or knowledge of the case

7

with anyone while the Court is in recess.

8

[The court-martial recessed at 1708, 10 June 2013.]

9

[The court-martial was called to order at 1720, 10 June 2013.]

10

MJ:

Court is called to order.

Let the record reflect all

11

parties present when the court last recessed are again present in

12

court.

13

still under oath.

14
15

The witness is in the courtroom.
Proceed.

ATC[CPT MORROW]:

Your Honor, at this time the prosecution has

no further questions for Agent Mander.

16

MJ:

17

ADC [CPT TOOMAN]:

18

You are reminded you are

Captain Tooman.
Thank you, ma’am.

Ma’am, before I begin my

cross examination I'd like to ask two voir dire questions ----

19

MJ:

That’s fine.

20

ADC[CPT TOOMAN]:

---- of the witness with respect to the

21

Tweets and the government assertion that they would like to admit it

22

for the effect of the listener.

23

MJ:

Okay.

8111

11661

VOIR DIRE EXAMINATION

1
2

Questions by the assistant defense counsel [CPT TOOMAN]:
Q.

3

Agent Mander, did you do find any evidence that PFC

4

Manning -- over the course of your investigation, did you find any

5

evidence that PFC Manning actually viewed those Tweets?

6

A.

I personally did not.

7

Q.

Did you look for it?

8

A.

I did not personally look for that evidence.

9

ADC [CPT TOOMAN]:

Did you look for that evidence?

I guess for our objection, Your Honor, we

10

would add relevance if there's no the evidence that PFC Manning

11

actually saw at Tweets there could be no effect on him.
MJ:

12
13

All right.

them?

14

ADC [CPT TOOMAN]:

15

MJ:

16

ADC [CPT TOOMAN]:

17

MJ:

18
19

So you have three objections to all three of

Okay.

Yes, ma'am.

Relevance, authentication, and hearsay.
Yes, ma'am.

Got it.

Questions continued by the assistant defense counsel [CPT TOOMAN]:
Q.

Agent Mander, I'd like to talk just a little bit about your

20

investigation generally.

21

that if you do something you document it.

22

A.

Sort of the tenant of your profession is

Yes.

8112

11662

1
2

Q.

And if you find a lead or a clue you're going to document

that as well, correct?

3

A.

Yes.

4

Q.

If you talk to a witness you'll document that?

5

A.

Yes.

6

Q.

If you researched something and uncover something relevant

7

to the investigation you would document it?

8

A.

Yes.

9

Q.

Now, over the course of your investigation in this case you

10

did a lot of different types of things you talked about on direct

11

examination.

12

A.

Yes.

13

Q.

You -- I think you reviewed e-mails?

14

A.

Yes.

15

Q.

You've reviewed chats?

16

A.

Yes.

17

Q.

You also reviewed financial transactions?

18

A.

Could you be more specific?

19

Q.

Did you look at banking records as well?

20

A.

I don't remember specifically looking at any banking

21
22
23

You did witness interviews?

records personally.
Q.

Okay.

So when you're looking at those various things, if

you have something important you put it up, you write it down in an

8113

11663

1

AIR and you notify kind of everyone who is involved that, hey, we’ve

2

got this lead and let's go after this, correct?

3

A.

Generally speaking, yes.

4

Q.

Now, thinking about all the things that you looked at in

5

this case you looked at chats and e-mails and witness interviews.

6

When you were investigating this case you knew what PFC Manning was

7

accused of, correct?

8

A.

Generally, yes.

9

Q.

You knew generally what the charges were against him?

10

A.

Depending on what point of the investigation initially, no,

11

there weren't any charges for, you know, extended period of time.

12

Q.

Okay.

13

A.

And I believe the charges at some point were modified, and

14

I don't know the legal term for that but.
Q.

15

Okay.

But when there were charges you knew what they were

16

and when the charges changed you knew what they were at that point as

17

well?

18

A.

Generally speaking, yes.

19

Q.

Over the course of your investigation you didn't find any

20
21

evidence that PFC Manning had antiAmerican beliefs, correct?
A.

Well, as we discussed when we had an interview, yourself

22

and myself, there was one thing that I mentioned to you that was

23

brought up by a witness of this case.

8114

11664

1

Q.

But not a witness you personally interviewed?

2

A.

Correct.

3

Q.

So in the course of your investigation, and I just want to

4

talk about the things you did and the things you looked at and the

5

people you talked to.

6

A.

Okay.

7

Q.

You didn't find any evidence or any indication that PFC

8

Manning was antiAmerican that he hated America?

9

A.

No.

10

Q.

You also didn't find any evidence that PFC Manning was

11

trying to help the enemy, that he wanted to affirmatively give

12

something to the enemy?

13

A.

Is that a question?

14

Q.

Yes.

You never found anything in witness interviews,

15

chats, e-mails where PFC Manning said something like I want to help

16

the enemy?

17
18
19

A.

I did not find anything where he said he wanted to help the

enemy.
Q.

Okay.

You also reviewed a lot of communications with

20

individuals and you would have noted any contact with the more than

21

nationals you would have noted, correct?

22

A.

Correct.

8115

11665

1
2

Q.

And you noted some, you found out some because PFC Manning

lived in Wales for a while so you had foreign contacts, correct?

3

A.

4

Q.

Yes.
And for a while that was kind of a focus of your

5

investigation you thought that maybe PFC Manning was working for some

6

sort of foreign intelligence service, correct?

7
8
9
10

A.

That wasn't really the CID focus.

That was probably more

of the Army Military Intelligence focus.
Q.

Okay.

But when you were conducting your interviews you

certainly explored that idea, didn't you?

11

A.

Yes, that was a question that we would have asked.

12

Q.

And you didn't find any evidence that he was associated

13

with any sort of foreign intelligence service, correct?

14

A.

I did not personally find that, no.

15

Q.

You also didn't find any evidence that PFC Manning was paid

16
17
18
19

in any way for any releases he may have done?
A.

I did not personally find out find any information that he

was paid.
ADC[CPT TOOMAN]:

At this time I’m going to retrieve what’s

20

been marked as Defense Exhibit Alpha for -- I’m sorry Foxtrot for

21

Identification.

22

Identification to the witness.

23

Q.

I'm handing Defense Exhibit Foxtrot for

Agent Mander, do you recognize that document?

8116

11666

1

A.

Yes, I do.

2

Q.

What is it?

3

A.

This appears to be a printout of a web page on

4

WikiLeaks.org website.

5

Q.

How do you know that?

6

A.

I printed this out and my initials appear on the lower

7

right-hand corner of each page.

8

Q.

How did you -- How did you find that document?

9

A.

This document is a variation of the other document that the

10

prosecution mentioned earlier.

11

MJ:

Which other document?

12

WIT: Say again?

13

MJ:

14

WIT: I believe it's Exhibit 110, if I'm not mistaken, ma’am.

15

ADC[CPT TOOMAN]:

16

WIT: And this document, the other document as well as some other

Which other document?

Prosecution Exhibit 110, Your Honor.

17

information relating to this most wanted leaks of 2009 document were

18

revealed via search on the Internet specifically using Google.

19

Q.

Okay.

And you did that search?

20

A.

I did that search.

21

Q.

And you printed that document?

22

A,

I printed that document.

8117

11667

1

ADC[CPT TOOMAN]:

I'm going to retrieve Prosecution, or I’m

2

sorry, Defense Exhibit Foxtrot for Identification and request the

3

Court’s permission to publish it?

4

MJ:

Proceed.

5

[There was a brief pause while the assistant defense counsel

6

published the exhibit to the Court.]

7
8
9

Q.

Now, you testified about a similar document on direct.

What is different about this document, Agent Mander?
A.

Well, the most notable difference from Exhibit 110 on the

10

top there where it says, ‘draft:themostwantedleaksof2009’, on the

11

other document Exhibit 110 document at the end of 2009 there's the

12

word hyphen, well excuse me, there’s a hyphen and then the word sort,

13

S-O-R-T.

14
15

Q.

Would you agree with me that this document also includes a

little bit more information at the top of the document?

16

A.

The documents are similar, but different.

17

Q.

Would you agree that this -- Defense Exhibit Foxtrot has

18
19
20
21
22

more introductory information than Prosecution Exhibit 110?
A.

Yes in the list of countries on the right versus the left

and there's obviously some other differences as well.
Q.

The biggest difference would be, you would agree would be

that and I'm pointing you to the very first paragraph here at the

8118

11668

1

top.

That paragraph does not appear on the version introduced by the

2

government, correct?

3

A.

I would have to see both documents again.

4

Q.

Okay.

5

A.

And look at them.

6

ADC[CPT TOOMAN]:

7

please.

I'll retrieve Prosecution Exhibit 110,

I'm going to hand Prosecution Exhibit 110 to the witness.

8

WIT: I'm sorry, could you repeat your question?

9

Q.

Would you agree that the introductory portion of the

10

Defense Exhibit Foxtrot for Identification is not included on

11

Prosecution Exhibit 110?

12

look through the entire document and just make sure for me that it

13

doesn't appear anywhere in there.

14
15

A.

Just there on the first page -- actually,

[Reviewing the document.]

The paragraph on the displayed

version does not appear to be in this document.

16

ADC[CPT TOOMAN]:

17

110 from the witness.

18

MJ:

19

ADC[CPT TOOMAN]:

20

MJ:

21

ADC[CPT TOOMAN]:

22

MJ:

I'm going to retrieve Prosecution Exhibit
Returning them to the court reporter.

May I see both of those exhibits quickly?
Yes, ma'am.

Well, you haven’t introduced yours yet?

Go ahead.

Not yet, ma’am.
I don’t need it.

8119

Go ahead.

11669

1

ADC[CPT TOOMAN]:

I’m giving Prosecution Exhibit 110 to the

2

court reporter.

3

Questions continued by the assistant defense counsel [CPT TOOMAN]:

4

Q.

Now, Agent Mander, you would agree with me that this

5

version Defense Exhibit Foxtrot, includes more information about how

6

this list was populated, correct?

7

to read that, please, do.

8
9
10

A.

And if you need to take a moment

This version is an editable version so that general members

of the public can edit this version.
Q.

And what this version says at the top is that the most

11

wanted leaks, the concealed documents are what they are, the

12

concealed documents are recordings most sought after by a country’s

13

journalists, activists, historians, lawyers, police, or human rights

14

investigators.

Do you agree with that?

15

A.

That's a paraphrase of what it says, sir.

16

Q.

A paraphrase or literally what it says?

17

A.

Paraphrase of what it says.

18

Q.

Okay.

We'll try it again.

2009's most wanted leaks-the

19

concealed documents are recordings most sought after by a country’s

20

journalists, activists, historians, lawyers, police, or human rights

21

investigators?

22

A.

That is exactly ----

23

Q.

Is that literally what it says?

8120

11670

1

A.

That’ literally what it says.

2

Q.

Okay.

3

And that paragraph didn't appear on the prosecution

exhibit, correct?

4

A.

It did not.

5

Q.

And you would agree with me that this demonstrates kind of

6

the purpose of WikiLeaks.

Would you agree with that?

7

A.

Can you be more specific?

8

Q.

Sure.

9
10

You would agree that this statement at the beginning

sets out why WikiLeaks wants these documents they don’t -- they want
it because they have been ----

11

ATC[CPT MORROW]:

12

MJ:

13

Objection, Your Honor, speculation.

Ask some foundational questions about whether he knows that

why WikiLeaks wants documents.

14

Q.

Agent Mander, do you know why WikiLeaks wants documents?

15

A.

I don't have the actual knowledge of why they want specific

16

documents.

I presume that ----

17

MJ:

18

WIT: My experience knowledge of this case.

19

Q.

Would this document also aid your presumption?

20

A.

Can you clarify your question?

21

Q.

When reading this introductory paragraph does that I guess

22

You presume based on?

inform your understanding of why WikiLeaks wants documents?

8121

11671

1

A.

It just seems to say that in 2009 those are the most wanted

2

documents by those groups of people.

3

WikiLeaks wants them.

4

Q.

It doesn't necessarily say why

Let's move down to this paragraph.

Can you see where I'm

5

pointing here?

6

‘document other materials added, nominated must,’ and you would agree

7

with me that it says, ‘be likely to have political, diplomatic,

8

ethical, or historic impact on release?

I'm pointing to the paragraph that starts with,

9

A.

That is what it says.

10

Q.

Okay.

Now, having read that and seen that, does that

11

inform your understanding of what WikiLeaks -- the purpose of

12

WikiLeaks and what they want?

13

A.

My understanding of this document is that they were trying

14

to create a list of documents that would be the categories listed

15

below where I just pointed out, things that are political,

16

diplomatic, or other things that would be impactful.

17
18

ADC[CPT TOOMAN]:

Your Honor, at this time the defense offers

Exhibit Foxtrot for Identification as Defense Exhibit Foxtrot.

19

MJ:

Any objection?

20

ATC[CPT MORROW]:

One moment, Your Honor.

Your Honor, the

21

objection would be authentication.

22

purports to be based on at least the witness' testimony.

8122

We're not sure what this document

11672

1

MJ:

All right.

Tell me one more time, you have Prosecution

2

Exhibit 110, which I did admit.

3

asking the witness now just a question here.

4

110, and I would like to see that exhibit now, if I could, and

5

Defense Exhibit Foxtrot together.

6
7
8
9

I'm not asking the government, I’m
Prosecution Exhibit

WIT: Ma’am, I’m handing you Defense Exhibit Foxtrot for
Identification.
MJ:

Special Agent Mander, Prosecution Exhibit 110 you've

already testified that it's different from Defense Exhibit Foxtrot.

10

Both of those exhibits, Defense Exhibit Foxtrot for Identification

11

have your initials and printed Saturday, June 1st on the bottom

12

right.

Is that correct?

13

WIT: That is correct.

14

MJ:

It looks like the one Defense Exhibit Foxtrot is printed at

15

15:39:36 and the Defense Exhibit Foxtrot for Identification was at

16

15:37:47.

17

- you printed that one after the government exhibit?

So Defense Exhibit Foxtrot for Identification came after -

18

WIT: If that's the way the times match up, yes, ma'am.

19

MJ:

I just want to ask the witness a couple of questions here

20

just because I’m confused.

21

ADC[CPT TOOMAN]:

22

MJ:

23

Yes, ma'am.

I'm going to hand you both of the exhibits and can you just

walk me through how you got them both and what you did?

8123

11673

1
2
3
4
5
6
7

WIT: There were some other documents that accompanied these.
Are those available?
ATC[CPT MORROW]:

Your Honor, those have been produced in

discovery, but they're not part of the exhibit.
MJ:

Okay.

Can you tell me what you did without referencing

those particular documents?
WIT: Ma'am basically conducted a search using I believe the

8

words the most wanted leaks of 2009, using Google.

9

numerous results that came as a result of that search and the first I

There were

10

believe it was the first four contained three versions of this list

11

or similarities to this list and the Prosecution Exhibit 110 was one

12

version of that list.

13

Foxtrot is another version of this list, and there was additionally a

14

third shorter version as well as a video related to the list.

15
16

MJ:

The, I guess Defense Exhibit F -- excuse me,

And did you print -- you printed both versions yourself,

right?

17

WIT: I believe I printed all three versions.

18

MJ:

Thank you.

Government your objection is authentication and

19

I admitted Prosecution Exhibit 110.

20

on authentication be the same?

21

ATC[CPT MORROW]:

22

really is relevance.

23

specific exhibit is.

Wouldn’t the basis for admission

Your Honor, actually, the better objection
I'm not sure what the relevance of this

8124

11674

1

MJ:

2

one relevant?
ATC[CPT MORROW]:

3
4

Well, if Prosecution Exhibit 110 is relevant why isn't this

one might be relevant.

5

MJ:

6

ATC[CPT MORROW]:

7

All right.

Go ahead.

on the basis of hearsay.

8

MJ:

9

ADC[CPT TOOMAN]:

10

They haven’t laid foundation for why this

Additionally, Your Honor, we'd also object
What are they offering it for?

Go ahead.
Would you like me to respond to that, Your

Honor?

11

MJ:

Yes, please.

12

ADC[CPT TOOMAN]:

Well, Your Honor, I guess most simply, you

13

admitted theirs, it’s the exact same thing done the exact same way so

14

it should be admissible.

15

106, Rule of Completeness if this is basically the same version.

16

you look at the URL, it is identical with the exception of a hyphen

17

sort.
MJ:

18

With respect to hearsay we would say Rule
If

So, they have the same URL with the exception of the hyphen

19

sort?

I didn’t look at that on the two exhibits.

I’m still

20

confused.

21

normally when you search Google something you get a list of things.

So, when you pulled this -- you pulled it up, you got,

22

WIT: Yes, ma'am.

23

MJ:

So they listed one, two, three, four or?

8125

11675

1

WIT: There was -- I believe there was ten results as a result of

2

the search on the page initially the Google results and then within

3

the first four results were different versions of this list, and

4

these are two versions of that list.

5

MJ:

I'm going to overrule the objection.

6

ATC[CPT MORROW]:

Any others?

Your Honor, the government notes that we

7

think the Rule of Completeness would assume the truth of the

8

statement or the truths of the statement.

9
10
11
12
13

MJ:

Why does the Rule of Completeness assume the truth of the

statement?
ATC[CPT MORROW]:

At least that’s the government’s

understanding of that Rule, Your Honor.,
MJ:

Isn’t Rule 106 -- usually -- Rule 106 would normally be one

14

document if part of the document then the other side can bring in the

15

rest of the document, right?

16
17
18

ATC[CPT MORROW]:

the difference of the document?
MJ:

Go ahead.
REDIRECT EXAMINATION

19
20
21
22
23

May I ask him a couple of questions about

Questions by the assistant trial counsel [CPT MORROW]:
Q.

Agent Mander, you said that you searched for WikiLeaks most

wanted and came up with a number of results?
A.

Yes.

8126

11676

Q

What -- when a number of results come up, what does that

3

A.

Can you be more specific?

4

Q.

Are they -- Were they in the same location on the Internet?

5

A.

Both documents were on the WikiLeaks.org website.

6

Q.

But, it wasn’t exactly -- you had to navigate from that

1
2

7
8
9

mean?

website to another place on the website.
A.

Is that correct?

When I initially went to the main WikiLeaks.org website

recently on June 1st you could not directly navigate to either one of

10

these lists.

11

Q.

12

ATC[CPT MORROW]:

13

MJ:

But the -- okay.
No further questions.

Well, wait a minute now I'm confused again.

14

out those documents and they say June 1st.

15

out if you never got them?

16

You printed

How could you print them

WIT: When I used Google I used the search term the most wanted

17

leaks of 2009.

That resulted in numerous search results.

These were

18

two of those results.

19

directly without searching for it there are many links and other

20

various bits of information on this page, however, there is nothing

21

that will immediately take you, or nothing you can click on that will

22

take you to either one of these lists from their main web page, their

23

home page.

If you go to the WikiLeaks.org website

Does that make it any clearer, ma'am?

8127

11677

1
2

MJ:

Let me just make sure I understand your testimony.

went on Google and this isn't Google cache, this is just Google?

3

WIT: This is Google.

4

MJ:

5

So you go on Google, and you found Defense Exhibit Foxtrot

for Identification and Prosecution Exhibit 110 in your search?

6

WIT: Yes, ma'am.

7

MJ:

8

WIT: Yes, ma'am.

9

MJ:

10

And they come up two of the ten results that you found?

And then if you go -- on June 1st -- and you printed it off

Google?

11

WIT: Correct.

12

the documents appeared.

13
14
15

You

MJ:

Well, I printed it off the actual location where

And then you went to the WikiLeaks website and you couldn’t

access them that way?
WIT: You cannot navigate to them from the home page of the

16

WikiLeaks.org website, meaning you could not click on anything on

17

that home image that would take you to these documents.

18

MJ:

19

WIT: If I may expound on that.

20

MJ:

21

WIT: I believe there was a question in regards to, could the

22

I think I understand.

All right.

Yes.

general public find these on the WikiLeaks website just by going to

8128

11678

1

the main website and presumably they wouldn't.

2

doing a search, but not going to the website directly.

3
4

MJ:

Okay.

I'm still in the same position I was in before.

If

Prosecution Exhibit 110 comes in then that’s ----

5

ATC[CPT MORROW]:

6

MJ:

7

They would find them

Your Honor, we'll withdraw the objection.

---- Defense Exhibit Foxtrot has the same ruling.

Proceed.

So, it’s admissible.

8

ADC[CPT TOOMAN]:

9

MJ:

Thank you, ma’am.

Do you want to give it to me, I'll sign it.

10

ADC[CPT TOOMAN]:

11

MJ:

12

ADC[CPT TOOMAN]:

I’m sorry, ma’am?

Do you want to give it to me and I’ll admit it.
Retrieve Defense Exhibit Foxtrot and

13

Prosecution Exhibit 110 from the witness, and, Your Honor, Defense

14

Exhibit Foxtrot and I'm going to hang onto this.

15

MJ:

16

ADC[CPT TOOMAN]: Ma'am, permission to publish Prosecution

17
18

Defense Exhibit Foxtrot for Identification is admitted.

Exhibit 110?
MJ:

Go ahead.

19

[There was a brief pause while the assistant defense counsel

20

published the exhibit to the Court.]

21
22

ADC[CPT TOOMAN]:

I'm placing on the overhead Prosecution

Exhibit 110, Page 9.

23

8129

11679

1
2

Questions continued by the assistant defense counsel [CPT TOOMAN]:
Q.

Agent Mander, you spoke on direct about a number of Intel

3

Link searches that you found that corresponded to things on

4

Prosecution Exhibit 110, correct?

5
6
7

A.

I did not actually find the Intel Link searches.

That was

someone else from the forensics team.
Q.

Right.

Okay.

You look at the Intel Link searches and

8

testified that some of the things -- the terms searched were items

9

that were similar to things on Prosecution Exhibit 110, correct?

10

A.

11

ADC[CPT TOOMAN]:

12

That's correct.
Okay.

At this time I'd like to retrieve

Prosecution Exhibit 81 and ask the witness to move to the panel box.

13

MJ:

14

Q.

All right.
I'm handing the witness what's marked as Prosecution
Agent Mander, what I'd like to do is we're going to go

15

Exhibit 81.

16

through this list and I'd like you to tell me whether or not there

17

are any searches in Prosecution Exhibit 81 that correspond with the

18

item on the list.

19
20

Okay?

ATC[CPT MORROW]:

that there are a number of searches for the information on this list.

21

MJ:

22

ADC[CPT TOOMAN]:

23

Your Honor, the government will stipulate

What do you want him to do?
Your Honor, the government highlighted I

think three instances where PFC Manning, or, rather, I should say,

8130

11680

1

computers associated with PFC Manning searched for terms that

2

correspond with items listed on this list.

3
4

MJ:

And you want to go through all of the ones where -- that

don't correspond?

5

ADC[CPT TOOMAN]:

6

MJ:

7

Yes, ma'am.

And government you're willing to stipulate the those three

are the only ones that correspond?

8

ATC[CPT MORROW]:

9

MJ:

All right.

10

ADC[CPT TOOMAN]:

11

MJ:

12

ADC[CPT TOOMAN]:

Yes, Your Honor.
In light of that, do you need to continue?
No, ma'am.

All right.
I will retrieve Prosecution Exhibit 81 from

I'm handing that back to the government.

13

the witness.

14

Questions continued by the assistant defense counsel [CPT TOOMAN]:

15

Q.

Agent Mander, if you would please return to the witness

16

stand.

I'm going to hand you Prosecution Exhibit 110 and I'd like

17

for you to count how many items are listed in that exhibit, please?

18

A.

Could you define the word item?

19

Q.

I'm sorry, under the United States.

20

Page 9.

21

A.

[Reviewing the exhibit.]

8131

I think it starts on

You say items there are bullets.

11681

ADC[CPT TOOMAN]:

1

Well, actually, I’ll retrieve the witness --

2

or I'll retrieve the exhibit from the witness and I will publish this

3

if that's all right with Your Honor?

4

MJ:

That's fine.

5

ADC[CPT TOOMAN]:

6

Exhibit 110.

7

Q.

8

Okay.

I’m publishing Page 9 of Prosecution

So, Agent Mander, if you could please count the items on

under United States there?

9

A.

Can you move it down a little bit?

10

Q.

Sure.

11

A.

Yeah, that's fine.

12

Q.

Okay.

13

A.

When you say items, we're talking about the bullet items --

15

Q.

Yes, the bullets, please.

16

A.

---- the subbullets?

14

This way?

--

There are, one, two, three, four,

17

five, there are at least five things that I can see different

18

categories, I guess you could say.

19
20

Q.

Okay.

Well, let's go with important bulk databases.

many items are listed under important bulk databases?

21

A.

There are three categories of items.

22

Q.

Okay.

23

A.

Correct.

And the next is federal politics?

8132

How

11682

1

Q.

How many items are listed there?

2

A.

There are one, two, six.

3

Q.

Okay.

And then next do you see Military Intelligence and
And

4

I'm going to move this up so we can see all of that subsection.

5

if you could please count I think on here count each bullet and

6

subbullet, because it appears that subbulets -- would you agree with

7

me that the subbullets are different than the main bullet?

8

A.

Sure, yes.

9

Q.

Or unique in some way?

10

A.

Yes.

11

Q.

Okay.

12

A.

It appears to be 21 bullets there.

13

Q

Okay.

So, if you would count those bullets for me.

And I'm now going to remove Prosecution Exhibit --

14

or Page 9 of the exhibit and put on Page 10 to the overhead.

15

see that okay, Agent Mander?

16

A.

Yes.

17

Q.

Okay.

18

Can you

If you would please count for me, we're still under

Military Intelligence.

So we're continuing from 21.

19

A.

Fifty-five excuse me 56.

20

Q.

Fifty-six visible on the screen there?

21

A.

Yes.

8133

11683

1

Q.

And the last one you see just for the record is blueprints

2

and floor plans of all unmentioned facility in the federal relocation

3

arc including historical ones?

4

A.

That's correct.

5

Q.

So 54 to there under Military and Intelligence, correct?

6

A.

Didn't I say 56?

7

Q.

I'm sorry, 56.

8

I'm now moving Page 10 up.

banking?

9

A.

There are two bulleted items.

10

Q.

And one under environment?

11

A.

That is correct.

12

Q.

Two under media?

13

A.

That is correct.

14

Q.

And two under religion?

15

A.

That is correct.

16

Q.

Okay.

I'm removing Page 10 and placing Page 11 on the

17

overhead and will continue with religion.

18

there?

19

A.

There are six more on this page.

20

Q.

Okay.

21

How many under

How many more do we have

I'm removing Page 11 and returning Prosecution

Exhibit 110 to the court reporter.

22

ADC[CPT TOOMAN]:

23

MJ:

All right.

No further questions, Your
Redirect?

8134

Honor.

11684

1

ATC[CPT MORROW]:

2

MJ:

3

ATC[CPT MORROW]:

No, Your Honor.

Temporary or permanent excusal?
Temporary, Your Honor.

4

[The witness was duly warned, temporarily excused, and withdrew from

5

the courtroom.]

6
7
8
9

MJ:

In the progression of your case is the next piece of it a

stipulation of expected of expected testimony or is it a witness?
TC[MAJ FEIN]: It’s actually a witness that’s sitting right out
here, ma’am, ready to go.

10

MJ:

11

TC[MAJ FEIN]:

12

All right.

A long or a short witness?
United States thinks she’s pretty short, ma’am,

it’s Ms. Glenn.

13

MJ:

Does either side have any objection to continuing?

14

CDC[MR. COOMBS]:

15

TC[MAJ FEIN]:

No, Your Honor.

Ma’am, the United States calls Ms. Shelia Glenn.

16

SHELIA GLENN, civilian, was called as a witness for the prosecution,

17

was sworn and testified as follows:
DIRECT EXAMINATION

18
19

Questions by the assistant trial counsel [CPT OVERGAARD]:

20

Q.

And you are Shelia Glenn?

21

A.

Yes, I am.

22

Q.

You work at Fort Meade, Maryland?

23

A.

Yes, I do.

8135

11685

1

Q.

What unit do you work for at Fort Meade?

2

A.

I work for Army Counterintelligence Center, 902nd MI Group.

3

Q.

And what is the 902 MI Group do?

4

A.

902nd conducts counterintelligence activities to protect

5

classified information and technologies and to detect, identify

6

foreign threats against U.S. Army.

7

Q.

And do you work for a particular subgroup under the 902nd?

8

A.

Yes, I do.

9

Q.

Okay and what does the Army Counterintelligence Center do?

10

A.

Army Counterintelligence Center produce timely, accurate,

I work for Army Counterintelligence Center.

11

comprehensive multi-discipline analysis to support combating

12

terrorism programs, ground system technologies, and investigation

13

operation activities.

14
15

Q.

And do you work for a specific branch under the Army

Counterintelligence Center?

16

A.

Yes, I do.

17

Q.

What branch is that?

18

A.

I work for Cyber Counterintelligence Assessment Branch.

19

Q.

And what does the Cyber Counterintelligence Assessment

20
21

Branch do?
A.

The Counter Cyber Intelligence Assessment Branch identifies

22

and performs analysis on cyber counterintelligence threats to the

23

United States Army.

8136

11686

1
2
3

Q.

And what is your job at the Army -- at the Cyber

Counterintelligence Assessment Branch?
A.

My job is a senior analysts and my job is to mentor junior

4

Soldiers and also to edit and review documents for content, accuracy,

5

and ----

6

Q.

How many analysts do you have there?

7

A.

We have five analysts that work under me.

8

Q.

Okay.

9

And how long have you been in that -- the senior

analyst position?

10

A.

I've been there for 2 years.

11

Q.

And how long have you been at the 902nd?

12

A.

I’ve been at the 902nd since 2000.

13

Q.

And what did you do before that?

14

A

I was in military for 20 years and I retired as Sergeant

15

First Class.

16

Q.

What did you do in the military?

17

A.

I spent 5 years as a Cryptographic Equipment Repair.

18

years as an Intelligence Analyst.

19

Q.

What kind of intelligence analyst?

20

A.

All source intelligence analyst.

21

Q.

And what has been your focus at the 902nd?

22
23

15

You said you're

under the Cyber Assessments Branch?
A.

Ah, yes.

My focus is cyber counterintelligence.

8137

11687

1

Q.

Okay.

And what does that mean?

2

A.

That means that I look at the foreign cyber threat,

3

identify and assess that threat to the United States Army

4

technologies and programs.

5
6

Q.

What sorts of -- you say you have five analysts that work

would under you?

7

A.

Yes.

8

Q.

What sorts of work product do the Cyber Analysts in the

9
10

Cyber CI Branch of ACIC produce?
A.

The Cyber CI Analyst produces ACIC special reports,

11

counterintelligence notes, inputs to FISTUS [phonetic] and input the

12

MCDCIDUS [phonetic] cyber inputs.

13

Q.

Okay.

Can we just -- We'll just focus on the ACIC special

14

reports prepared by the Cyber CI Branch.

15

one is distinct from the other ones that you named?

16
17
18
19
20
21

A.

Can you tell us how that

The ACIC special report is a comprehensive document.

It

uses I the full spectrum analysis and it uses predictive analysis.
Q.

And are there different types of these special ACIC

reports?
A.

Yes, there -- Basically we write ACIC special reports based

on requirements, request for information, or self-initiated.

22

Q.

23

report?

What's the purpose of this self-initiated Cyber CI special

8138

11688

1

A.

In a self-initiated report we identify potential threat to

2

U.S. Army and we inform the commander about that threat to their

3

organization.

4

MJ:

5

Before you continue.

You said there were three of them,

requirements, something else and?

6

WIT: Request for information.

7

MJ:

Thank you.

8

Q.

And just focusing in on the self-initiating Cyber CI

9
10

special reports, can you tell us how those are prepared?
A.

Oh, yes.

Our first analyst comes up with -- First the

11

analyst while they are doing their research they come across some

12

information that they think might be of a CI interest to the United

13

States Army.

14

and see if there's something that, you know, that the supervisor will

15

approve for them to go ahead and produce.

16

what they know and what they don't know about that event or

17

organization or whatever they’re writing about.

18

at what they have and what they don't have, then they start doing

19

research.

20

reporting.

If it is, then they talk about it with their supervisor

So then an analysts lists

Okay once they look

They do the research using classified and unclassified

21

Q.

Where do they conduct this research?

22

A.

They conduct this research on classified systems, JWICS

23

SIPRNET and unclassified systems, open source.

8139

11689

1
2
3

Q.

What kinds of things are they looking at when they are

conducting their research?
A.

They're looking at -- They are looking at everything.

4

They're looking at HUMIT reporting, they're looking at SIGINT

5

reporting, they are looking at OSINT reporting, imagery reporting and

6

massive reporting.

7

Q.

So after they -- After an analyst does this research,

8

what's the next step in creating this self-initiating special report

9

for Cyber CI?

10

A.

Okay.

Once they finish their research, then the analyst

11

will look at the order of the stuff they want to compile.

12

basically build an outline and they put the information that they

13

collected within that outline and then they want to answer the

14

questions, you know, the who, what, why, where, and how, and then

15

they want to say what’s next.

16

they also look at the impact against U.S. Army interests and U.S.

17

interests.

18
19
20
21
22
23

Q.

So

They want to look at what’s next and

And then do they -- When do they start writing their

product?
A.

After they collect all the information and

put it in the

outline then they start writing the product.
Q.

And after -- I guess what's the process then for writing

that product?

8140

11690

1

A.

Okay.

For writing the product you pull all intelligence

2

information together.

You look at the impact.

You group the

3

information and then you put it in a template.

4

for these reports.

5

you can answer all the who, what, why, where, and what's next.

We have a template

So, we put it in a template and make sure that

6

Q.

And after that report is drafted, what happens to it?

7

A.

After the report is drafted it goes to the senior analyst

8

who reviews it for content, accuracy, and grammar, and once the

9

senior analyst reviews it, then it goes out for coordination,

10
11
12
13

external coordination.
Q.

I'm going to step back a little bit.

and accuracy verification?
A.

Okay.

What's the content

What does that entail?

When we look at it for content and accuracy, we're

14

making sure that information within the report is correct.

15

check the sources that are used in the report to make sure that they

16

agree with the information within the report states and then we check

17

for grammar.

18

Q.

And then you said you send it out for coordination?

19

A.

Yes, we do.

20

Q.

What does that mean?

21

A.

When we send it out for coordination to external sources,

22

We fact

which means we send it to other intelligence agencies so they can

8141

11691

1

actually review the report to make sure that have the information

2

accurately.

3

Q.

And what happens after the external coordination?

4

A.

When we did get our results back from the external

5

coordination we check the comments that the organizations put within

6

the report and if we agree with the comments then we incorporate them

7

within the reports.

8

an alternative analysis statement within that report.

If we disagree with the comments then we put

9

Q.

Is that required?

10

A.

Yes, it is.

11

Q.

And what happens after the external coordination, what

12
13
14

happens to the product next?
A.

External coordination of the product is reviewed by the

branch chief.

15

Q.

It goes -- what, if anything new is added?

16

A.

If anything new is added it goes back to the senior analyst

17

who reviews that information and then it goes to the branch chief.

18

Q.

What happens -- What does a branch chief do?

19

A.

The branch chief reviews the product again for content,

20

accuracy, and grammar.

21

Q.

What happens after that?

22

A.

After the product is reviewed by the branch chief then it

23

goes to the editors for them to review it.

8142

11692

1

Q.

Again, for content and accuracy?

2

A.

They review it for grammar and content.

3

Q.

Okay.

4

A.

I mean grammar and accuracy.

5

They don't review it for

accuracy, they review it for grammar.

6

Q.

Okay.

So what happens after the editor is done?

7

A.

Once the editors finish their job then it goes to the

8

director or deputy director to be review for content, accuracy, and

9

grammar.

10
11

ATC[CPT OVERGAARD]: Your Honor, I'm going to retrieve
Prosecution Exhibit 45 for Identification.

12

MJ:

13

ADC[CPT TOOMAN]:

14

MJ:

Okay.

15

Q.

I'm handing Prosecution Exhibit 45 for Identification to

16

the witness.

17

A.

It's a ACIC special report.

18

Q.

How do you know that?

19

A.

Because it states on the top of the document ACIC special

20

Yes?
I’m just going to look at it, Your Honor.

Can you tell us what that is?

report and it has a ACIC serial number on it.

21

Q.

And you're familiar with those documents?

22

A.

Yes, I am.

23

Q.

How are you familiar with it?

8143

11693

1

A.

We write them.

2

Q.

Okay.

3

A.

Yes, I have.

4

Q.

And what type of product is -- is that document or is that

5

Have you written them yourself?

report in particular?

6

A.

This is a self-initiated document.

7

Q.

And who wrote that product?

8

A.

Mr. Mike Horvath.

9

Q.

Who is Mike Horvath?

10

A.

Mike Horvath was the senior analysis at the time.

11

Q.

What was your involvement in creating that product?

12

A.

Mike discussed the subject with me and I reviewed it for

13

content and grammar and accuracy.

14

Q.

So you're familiar with the content?

15

A.

I'm familiar with the content, yes.

16

Q.

And why did you review the product?

17

A.

Because we have a two review process within our

18

organization.

19

Q.

Is this a product you reviewed in 2008?

20

A.

Yes, it is.

21

Q.

Is it different in any way?

22

A.

Yes, it is.

23

Q.

How is it different?

8144

11694

1

A.

It's been declassified and it’s missing the end notes.

2

Q.

Is the content otherwise the same?

3

A.

Yes, it is.

4

Q.

And do you -- What happened to the product -- what happened

5

to this product in particular after it went through the process that

6

you discussed before?

7

A.

It was posted to our website.

8

Q.

Where is your website?

9

A.

On SIPRNET and JWICS.

10

Q.

Is that product still on the ACIC portal?

11

A.

Yes, it is.

12

Q.

How do you know that?

13

A.

I checked it.

14

ATC[CPT OVERGAARD]: Your Honor, at this time the United States

15

moves to admit what has been marked as Prosecution Exhibit 45 for

16

Identification into evidence as Prosecution Exhibit 45.

17

ADC[CPT TOOMAN]:

18

MJ:

19

No objection, Your Honor.

May I see it, please?

Identification is admitted.

Prosecution Exhibit 45 for

Does the witness need the document back?

20

ATC[CPT OVERGAARD]: Yes, ma'am.

21

MJ:

22

ATC[CPT OVERGAARD]: Thank you.

There you go.

23

8145

11695

1
2
3
4
5

Questions continued by the assistant trial counsel [CPT OVERGAARD]:
Q,

Ms. Glenn, can you tell us the name of that product that I

handed you?
A.

WikiLeaks.org a on-line reference to foreign intelligence

services, insurgents or terrorist groups.

6

Q.

What is that letter and number combination under the title?

7

A.

Underneath there is the production center, first four

8

digits, the second is the function code, the third is the serial

9

number, and the last two is the fiscal year.

10
11

Q.

And under that what is the publication date of this

document?

12

A.

18 March 2008.

13

Q.

And how about the information cutoff date?

14

A.

28th February 2008.

15

Q.

Can you tell us what the information cutoff date means?

16

A.

That's the last current reporting that's contained in this

17

report.

18

Q.

What does it say under the publication date?

19

A.

National security information, unauthorized disclosure

20

subject to criminal sanctions.

21

Q.

What is the national security information?

22

A.

Information that has been determined that it needs to be

23

protected from unauthorized release.

8146

11696

Q.

What specific types of national security information are in

3

A.

Intelligence reports produced by originators.

4

Q.

And you already us what the external coordination means,

1
2

5

here?

but can you tell us what that line represents?

6

A.

External coordination?

7

Q.

Yes.

8

A.

That’s the organization that performed the external

9

coordination.

10

Q.

Okay.

11

A.

Yes.

12

Q.

---- coordinate with?

13

So that’s who it was sent to ----

And how about that next line?

Can

you tell us what that means?

14

A.

Which one?

15

Q.

The product response to Headquarters, Department of Army?

16

A,

17

MJ:

18
19

That's.
Is there at all a way to publish so that I can follow

along.
ATC[CPT OVERGAARD]: Yes, ma'am.

I can publish the copy that I

20

have right here, ma'am.

21

[There was a brief pause while the assistant trial counsel published

22

the exhibit to the Court.]

8147

11697

1
2
3
4
5
6

Q.

We're at the line I’m pointing to beginning with, ‘this

product’.
A.

Can you just tell us again what that means?
That's the production requirement that was used to produce

this document, to authorize the production of this document.
Q.

And then how about that last line on there that says, ‘ACIC

production or product identification number’.

What does that mean?

7

A.

That's the ACIC serial number for this product.

8

Q.

Okay.

9

A.

The ‘R’ being -- designates ACIC.

Does that serial number have any specific meaning?
The ‘08’ is the fiscal

10

year, and the serial number is the same as the one above, the serial

11

number.

12

Q.

Okay.

13

A.

One, two, three, four, five, six on up.

14

Q.

And you mentioned before that you have templates for your

15

It’s just a numerical order of the reports.
So there's just assigned ----

documents?

16

A.

Yes, we do.

17

Q.

What is the template for this document?

18

A.

The template for this document is the title, purpose,

19

executive summary, key judgments background, discussion, conclusion

20

oh, Intel gaps, conclusion, and contact.

21

Q.

Intel gaps and conclusions?

22

A.

And point of contact.

23

Q.

In 2008 that was the template you used?

8148

11698

1

A.

Yes, in 2008 that was the template we used.

2

Q.

Can you just tell us a little bit about how this -- this

3

self-initiated product was prepared, this specific product?
A.

4
5

Mr. Horvath was doing research and came across

WikiLeaks.org and he thought it was a CI concern.
ADC[CPT TOOMAN]:

6

Objection.

This witness would have no

7

personal knowledge of what prompted Mr. Horvath to write this

8

document.

9

Q.

Are you testifying to your personal knowledge?

10

A.

Yes, I am, because I discussed this with Mr. Horvath during

11

that time frame.
ADC[CPT TOOMAN]:

12
13

Honor.
MJ:

14
15

We would object based on hearsay, Your

What's the relevance, or are you introducing it as hearsay

or not?
ATC[CPT OVERGAARD]: One moment please, ma’am.

16

Ma'am, we'll

17

stick with her personal observation and not any discussions that were

18

had.

19

MJ:

Objection, sustained.

20

Q.

Can you tell us what specifically was done to create this

21
22

self-initiated product?
A.

The steps?

8149

11699

1
2

Q.

Yes.

Did -- Yes, the steps that Mr. Horvath took and the

steps that you took in assisting him?

3

A.

4

before.

5

Q.

Okay.

6

A.

I assisted in some research and in reviewing and editing

7

Mr. Horvath used the same procedures that I talked about

the document.

8

Q.

And are these documents, are they usually 32 pages long?

9

A.

The documents can be much smaller, five pages, or they can

10

be much larger, 150 pages.

11

Q.

Okay.

12

A.

Average usually about 20 to 30 pages.

13

Q.

14
15
16
17
18

And let's talk a little bit about the content of this

actual report.
A.

What's the average, I mean, what are they usually?

Yes.

Do you know what the purpose of this document is?
The purpose of this document was to assess the

counterintelligence threat on the U.S. Army by WikiLeaks.org website.
Q.

And according to the report and your knowledge of the

report, what is WikiLeaks?

19

A.

WikiLeaks is an organization that exposes illegal activity.

20

ADC[CPT TOOMAN]:

21

MJ:

Objection, Your Honor.

Yes.

8150

11700

1

ADC[CPT TOOMAN]:

I don't believe this witness is in a

2

position to determine the legality of the WikiLeaks’ weekly conduct -

3

- the conduct of WikiLeaks.

4
5
6

ATC[CPT OVERGAARD]: Ma’am, She's testifying about what the
product actually says.
MJ:

All right.

I'm not taking her testimony to be a legal

7

opinion of whether something is legal or illegal.

8

it to what purports to be illegal activity.

9

ATC[CPT OVERGAARD]: Yes, ma'am.

Why don’t we take

Go ahead.

The purpose of testimony is

10

only to elicit what is actually in the document not what WikiLeaks is

11

or is not, but what is written in the document.

12
13

MJ: Go ahead.
Questions continued by the assistant trial counsel [CPT OVERGAARD]:

14

Q.

15

report?

16

A.

So, can you tell us what WikiLeaks is according to this

Okay.

I would -- According to the report, it says, ‘That

17

the intent of WikiLeaks website is to expose unethical practices,

18

illegal behavior, and wrongdoing within corrupt corporations and

19

governments’.

20
21

Q.

And does the report comment on whether or not WikiLeaks is

a news organization?

22

A.

Yes, it does.

23

Q.

And what does it say?

8151

11701

1
2

A.

It says that, ‘WikiLeaks.org is not considered a news

organization’.

3

Q.

And does it give some reasons for that?

4

A.

Yes, it does.

It says that, ‘WikiLeaks does not vet their

5

sources.

6

provide source checking or facts checking, and WikiLeaks does not

7

provide -- WikiLeaks does not confirm the accuracy of the

8

information’.

WikiLeaks does not provide overview.

WikiLeaks does not

9

Q.

Does it talk about how WikiLeaks releases information?

10

A.

Yes, it does.

11

Q.

What does it say about that?

12

A.

It says, ‘WikiLeaks.org uses anonymous methods to post the
So, let me find it in here.

It says,

13

information to the sites’.

14

‘WikiLeaks.org uses its own coded and software combined with

15

WikiMedia, WikiOpen, as a self-free net tour, and PDC to make it

16

difficult for foreign governments, FIS, law enforcement agencies, and

17

foreign businesses to determine where a leak document originated from

18

and who was responsible for leaking the document’.

19

Q.

Can you tell us what page you're looking at?

20

A.

I'm looking at Page 5.

21

Q.

What paragraph was that?

22

A.

Paragraph 3.

8152

11702

1
2
3

Q.

Does it talk about -- Does this product further talk about

what type of behavior, this anonymous releasing encourages?
A.

Yes.

The document says that, ‘the anonymous behavior

4

encourages,’ let me get the exact words.

It says that, ‘the

5

WikiLeaks.org is knowingly encouraging criminal activities such as

6

the theft of data, documents, proprietary information and

7

intellectual property.

8

regarding, sedition and espionage and possible violation of civil

9

laws within the United States and foreign countries.

Possible violations of national security laws

They allege

10

that whistle blowers are in effect willingly violating laws and

11

conditions of employment and thus may not qualify as whistle blowers

12

protected from the disciplinary action or retaliation from reporting

13

wrongdoing in countries that have such laws.’

Page 20.

14

Q.

Okay.

15

A.

Page 20, Paragraph 1.

16

Q.

That one or that one?

17

A.

That one.

18

Q.

Okay.

19

A.

Page 19 it starts.

20

Q.

Okay.

21

A.

WikiLeaks propo -- WikiLeaks propose a force protection

22

What paragraph on Page 20 were you looking at?

The top paragraph, the half paragraph?

According to this what threat does WikiLeaks pose?

Cyber Counter -- Cyber Intelligence, excuse me, not Cyber Intel --

8153

11703

1

force protection, counterintelligence, information security, and

2

operation security threat.

3

Q.

And is that -- That's in the key judgments?

4

A.

Yes, it is.

5

Q.

And what else or what does the key judgment say about how

6

it does this, how WikiLeaks does this?

7

on Page 3?

8
9

A.

Okay.

Just looking at key judgments

It says, ‘Recent unauthorized release of DoD and

sensitive and classified information provided, FIS, foreign

10

terrorists groups and insurgents and other foreign adversaries with

11

potentially actionable information for targeting U.S. forces’.

12
13

Q.

Does the report discuss any examples of information that

are posted on WikiLeaks?

14

A.

Yes.

This report has three examples.

15

Q.

What were those three examples?

16

A.

The first example was the release of tables of equipment

17

for troops deployed in Iraq and Afghanistan.

18

release of a standard operation procedures for Joint Task Force

19

Guantanamo.

20

that is produced by National Ground Intelligence Center.

21
22
23

Q.

The second example was

The third example was a classified document released

What information in particular according to this report was

in the TO&E, the tables of equipment that you just mentioned?
A.

The Report.

8154

11704

1

Q.

Just in general what is in -- What was in the TO&Es?

2

A.

The TO&E had a list of all equipments -- all equipment that

3
4
5
6

was deployed in Afghanistan and in Iraq.
Q.

And did the products say anything about the dangers of

releasing that information?
A.

Yes.

It said that the products stated that, ‘the release

7

of that information could allow foreign intelligence service

8

terrorist groups, Iraqi insurgents to conduct attacks against U.S.

9

Army forces in

10

ADC[CPT TOOMAN]:

11

MJ:

12

ATC[CPT OVERGAARD]: Ma’am, it's relevant to the accused's

13

Objection.

Relevance, Your Honor.

What is the relevance?

knowledge.

14

MJ:

All right.

Overruled.

15

Q.

All right.

You can continue.

16

A.

The identification of vehicles, military vehicles, could be

Sorry.

17

used to select specific types and emplacements of improvised

18

explosive devices.

19
20

Q.

And then you also mentioned that there was an NGIC report,

a National Ground Intelligence Report?

21

A.

Yes, there is.

22

Q.

What did that contain?

8155

11705

1
2
3
4

A.

That report discussed asymmetrical warfare, tactic,

techniques, and procedures used against U.S.
Q.

And what was -- What was the classification of that

document?

5

A.

That document was classified Secret NOFORN.

6

Q.

And that was also released by WikiLeaks?

7

A.

Yes, it was.

8

Q.

And according to the product what could be the impact to

9
10

the United States if that were released?
A.

The impact would be insight into a successful asymmetric

11

warfare tactic, techniques and procedures, operation against U.S.

12

forces and coalition forces.

13

Q.

And is this an intelligence product?

14

A.

Yes, it is.

15

Q.

And why is it an intelligence product?

16

A.

Because it contains intelligence documents within it.

17

Q.

Do other U.S. government entities rely on these

18

intelligence products?

19

A.

Yes, they do.

20

Q.

And was this product in particular used by other U.S.

21

government entities?

22

A.

Yes, they were.

23

Q.

How do you know that?

8156

11706

1

A.

Because people have discussed it, feedback.

2

Q.

Was this product ever released outside of SIPRNET?

3

A.

No, it wasn't.

4

MJ:

When you are saying, this product, are you talking about

5
6
7
8
9
10
11

the NGIC report or are you talking about the ACIC report?
ATC[CPT OVERGAARD]: I'm sorry, ma'am.

I'm talking about this

report -- the ACIC report.
Q.

Was this -- Was the 2008 version that you're familiar with

of the ACIC report ever released outside of SIPRNET?
A.

To my knowledge it was only posted on SIPRNET and JWICS and

never released out of those two sites.

12

Q.

Was it ever unofficially released?

13

A.

To my knowledge, no, it wasn't.

14

Q.

You're not familiar with this document being unofficially

15

released anywhere else?

16

A.

Unofficially released?

17

Q.

Not officially, unofficially so ----

18

A.

Oh, okay.

19

I'm sorry. I thought you said -- To my

knowledge, this document was never unofficially released.

20

Q.

So ----

21

A.

I mean never officially released.

22

Q.

Okay.

23

A.

Yes.

I'm sorry.

Was it unofficially released though?
You’ve got me confused here?

8157

11707

1

Q.

Do you know if this document was ever released?

2

A.

No.

3

Q.

Even unofficially.

4

A.

To my knowledge, this document was never un -- officially

5
6

To my knowledge, the document was never released.

released?
Q.

Okay.

Can you tell us -- can you tell us, according to the

7

conclusion of this document, what must be presumed about adversary --

8

yes, adversary access to WikiLeaks?

9

A.

I'm just looking at Page 21.

‘It must be presumed that WikiLeaks organization have or

10

will receive sensitive or classified documents in the future.

11

must also be presumed that foreign adversaries will review and assess

12

any DoD or classified information posted on the WikiLeaks.org

13

website’.

14

Q.

Thank you.

15

A.

Yes, it was.

16

Q.

And how do you know that?

17

A.

Because I was informed by an individual who saw on it

18

It

Was this document ever posted on WikiLeaks?

WikiLeaks.

19

ADC[CPT TOOMAN]:

Objection?

20

MJ:

Okay.

21

Q.

Do you have firsthand knowledge?

22

MJ:

Sustained.

23

ATC[CPT OVERGAARD]: Sorry, ma’am.

8158

11708

1

Q.

Do you have firsthand knowledge of that?

2

A.

Yes, I do.

3

Q.

And what is your firsthand knowledge of that?

4

A.

I received a phone call from

5

MJ:

Sustained.

6

Q.

Did you see the product?

7

A.

It was e-mailed to me.

8

Q.

Okay. And it was from WikiLeaks?

9

A.

It was e-mailed to me from somebody who took it off of the

10

WikiLeaks.

11

Q.

And how do you know that?

12

A.

It looked like the exact same document that was posted to

13

our website.

14

Q.

15

What did it look like?

Did it have anything -- any particular identifying marks on

it that made you that think it was from WikiLeaks?

16

A.

No, not the document that I received.

17

Q.

Okay.

18

A.

But I received it on an unclassified system.

19

Q.

Okay.

20

MJ:

Cross?

21

ADC[CPT TOOMAN]:

Thank you.

Yes, ma'am.

22
23

8159

11709

CROSS-EXAMINATION

1
2

Questions by the assistant defense counsel [CPT TOOMAN]:

3

Q.

Good evening, Ms. Glenn.

4

A.

Good evening.

5

Q.

I'm going to retrieve that exhibit from you, Prosecution

6

Exhibit 45.

Thank you.

7

ADC[CPT TOOMAN]:

8

MJ:

9

ADC[CPT TOOMAN]:

10
11
12

Ma'am, I'm going to publish this.

Go ahead.
I'm now publishing Page 1 of Prosecution

Exhibit 45.
Q.

Ms. Glenn, my first question for your is:

direct about the title of this document, correct?

13

A.

Yes.

14

Q.

And you read it to the Court.

15

You talked on

Would you agree that the

title of this document actually has a question mark at the end?

16

A.

Yes, it does.

17

Q.

Okay.

And so that would suggest, would you agree, that we

18

don't know the answer to that question or this document is going to

19

set out to answer that question?

Would you agree with that?

20

A.

Could you repeat the question?

21

Q.

Sure.

You would agree that based on the title, this

22

document, that is a question, that is we don't know whether foreign

23

intelligence services, insurgents, or terrorist groups use WikiLeaks

8160

11710

1

as an on-line reference.

Would you agree with that?

2

mark would suggest that we don't know.

The question

Do you agree with that?

3

A.

The question mark suggest that we can't confirm it.

4

Q.

Okay.

5

A.

Not that we don't know, but we can't confirm it.

6

Q.

Okay.

7

And so ----

We can confirm it.

Okay.

If we could confirm it

there wouldn't be a question mark there, correct?

8

A.

At that time, yes.

9

Q.

I'm sorry?

So if there were no question mark there you

10

would agree with me that that would suggest that foreign intelligence

11

service, insurgents, and terrorist groups are using WikiLeaks as an

12

on-line reference?

13

A.

During that timeframe we couldn’t confirm it.

14

Q.

Okay.

Now I'm going to remove Page 1 from the overhead and

15

place Page 2.

You talked on direct about the stated purpose of

16

WikiLeaks, and I would direct your attention to the second paragraph

17

from the bottom which is the one denoted by the ‘U’ the unclassified

18

paragraphs there.

Do you see that?

19

A.

Yes.

20

Q.

You would agree with me that the stated intent of WikiLeaks

21

is to expose unethical practices, illegal behavior, and wrongdoing

22

within corrupt organizations or corporations, and oppressive regimes

23

throughout the world.

Is that accurate?

8161

11711

1

A.

That was the stated intent.

2

Q.

Okay.

3

It doesn’t -- The stated intent is to not to assist

foreign militaries, correct?

4

A.

I can't make that determination.

5

Q.

Okay.

6

Well, that wasn't stated, you would agree with that,

correct?

7

A.

That's not stated within the document, yes.

8

Q.

Okay.

9

the overhead.

Now, continuing to talk and I've removed Page 2 from
I'm going now to place Page 6 on.

Continuing to talk

10

about the stated purpose of WikiLeaks.

11

attention to the first full paragraph there, the one with the ‘U’ in

12

parenthesis, starts ‘WikiLeaks.org’.

13

first paragraph there for me.

14

my pen.

15

A.

‘WikiLeaks.org’ ----

16

Q.

Just read it to yourself, ma'am, I’m sorry?

17

A.

Oh, okay.

18
19

as directed.]
Q.

I want to direct your

Go ahead and read that first --

I'll point to that paragraph here with

[The witness reviewed the portion of the exhibit

Okay.

Ma'am, based on this report would you agree with me that

20

one of the purposes or the goals of WikiLeaks is a free and

21

unrestrained press?

22

A.

Would you agree with that ma'am?

Based on this statement, yes.

8162

11712

1

Q.

Removing Page 6.

Ma'am, I'd like to talk now a little bit

2

about how these documents are created.

Okay?

Now, you talked about

3

a few different ways in which one of these products could be

4

initiated.

5

that's what happened in this case?

You talked about it could be self-initiated, correct, and

6

A.

Uh, huh [indicating an affirmative response].

7

Q.

I'll just ask you to say your answer out loud for the

8

purpose of the court reporter.

9

A.

Yes.

10

Q.

Okay.

11

Thank you.

Another way would be through an RFI,

correct?

12

A.

Request for information, yes.

13

Q.

Okay.

14

A.

That's when a command sends us through e-mail or a request

Could you explain what this is, please?

15

for information on a particular item and then we would research it

16

and produce a product off of it.

17
18

Q.

So if there were requests for information, and there wasn't

a request for information in this case, correct?

19

A.

No, this is self-initiated.

20

Q.

So no unit came to ACIC and said, hey, we think that maybe

21

WikiLeaks is using, or the enemy is using WikiLeaks, we'd like you to

22

look into it, correct, that didn't happen?

23

A.

No.

No request for information.

8163

11713

1
2

Q.

Okay.

And you mentioned a third way in which one of these

documents would be initiated.

What was that, ma'am?

3

A.

A requirements.

4

Q.

Okay.

5

A.

That’s through our production system.

And could you explain what that means?
A customer will put

6

in a request for assessment and then we will perform that assessment

7

based on their request.

8
9
10

Q.

So if someone had said, hey, we think that maybe WikiLeaks

is getting used by the enemy, they could have used that process in
order to have this product produced.

11

A.

Yes, they could have.

12

Q.

Okay.

13

A.

No, it didn't.

14

Q.

Okay.

Is that correct?

And that didn't happen here, correct?

Now, I'd liked to speak now about sort of the

15

process through which this is created.

Once it's been initiated here

16

we had self-initiation and then you talked about all the research

17

that goes into it, right?

18

A.

Yes.

19

Q.

And I think you talked about in this case it would be Mr.

20

Horvath or whoever drafted the document would have looked at JWICS.

21

Is that correct?

22

A.

Yes.

8164

11714

1

Q.

So Mr. Horvath would have looked at JWICS and he would have

2

been looking for any sort of intelligence that would have helped

3

answer the question posed by this paper?

4
5
6

A.

He would use that, but that wouldn't be the only source

that he would use.
Q.

Sure, okay.

Within JWICS, you would agree that JWICS is

7

where the United States Government keeps Top Secret information,

8

correct?

9

A.

10

Secret.

11

Q.

12

There's other information on JWICS.

Sure, thank you.

It’s not only Top

So, you would have not only Top Secret

information on JWICS, but other information as well?

13

A.

Yes.

14

Q.

There's a lot of information on JWICS?

15

A.

Yes.

16

Q.

You've got the SIPRNET and that includes Secret and down,

17

correct?

And then JWICS is higher.

18

A.

Yes.

19

Q.

Okay.

20

So there's even more on JWICS?

And you talked about a number of INTs that would

have been referenced when producing this document?

21

A.

Yes.

22

Q.

There was HUMINT?

23

A.

Yes.

8165

11715

1

Q.

SIGINT?

2

A.

Yes.

3

Q.

OSINT?

4

A.

Yes.

5

Q.

MASINT?

6

A.

Yes.

7

Q.

Did I miss any?

8

A.

IMINT.

9

Q.

IMINT, okay.

10

So all of those INTS would have been looked

at by the individual who drafted this document?

11

A.

Yes.

12

Q.

Pretty much the author of this document had just about all

13

of the United States Government's intelligence at their fingertips.

14

Is that fair to say, with some very limited exceptions, they were

15

looking at just about everything?

16

A.

Yes.

They was [sic] looking at just about everything, yes.

17

Q.

Now, so the individual who drafted the document would have

18

looked at all of this information and they incorporated that into

19

their document?

20

A.

If they found something.

21

Q.

Sure.

If they found something, if they found a source they

22

would have noted it in this document and then after the document was

23

written it would have gone out for external coordination, correct?

8166

11716

1

A.

Yes.

2

Q.

Okay.

And in this case Mr. Horvath looked at all of this

3

information, all of JWICS, all the INTS and then he sent it out to

4

the National Ground Intelligence Center, correct?

5

A.

Yes.

6

Q.

And they scrubbed it as well?

7

A.

Yes.

8

Q.

And so if they would have had any intelligence that maybe

9
10

Mr. Horvath missed or maybe didn't have access to they could have
added it on this document, correct?

11

A.

Yes.

12

Q.

And so this external coordination is a process through

13

which we can make sure we have as much intelligence as possible in

14

forming this paper, correct?

15

A.

Yes.

16

Q.

Now, I want to talk about the document itself.

17

document there are footnotes, correct?

18

A.

There are end notes.

19

Q.

End notes, okay, I’m sorry.

20
21
22
23

Through the

End notes.

And what is the

purpose of an end note?
A.

The purpose of the end note is to list where you acquired

the information from.
Q.

So it's the source, is that accurate?

8167

11717

1

A.

Yes, it's the source.

2

Q.

So if there was an intelligence report that said Captain

3

Tooman eats too many cookies.

There would be an end note and then

4

someone would have -- you’d have the source of that information?

5

A.

Yes.

6

Q

And it might be my mother or someone else, right?

7

A.

Yes.

8

Q.

That's how an end note would work?

9

A.

Yes.

10

Q.

Now, I want to -- I'm going to publish Page 11.

I'll

11

direct your attention to sort of the middle of the paragraph here we

12

have a paragraph that was Secret NOFORN, it's been lined through.

13

starts, ‘Intelligence indicates that insurgents’.

14

you see that?

Right here.

15

A.

Yes.

16

Q.

That says intelligence indicates that insurgents in

It

Do

17

Afghanistan have recovered several Warlock systems and then we have

18

an end note.

19

but if we were looking at the classified version we can go to Number

20

22 the at the back and we can see the source of that information,

21

correct?

22

A.

And we have the unclassified version of this document,

Yes.

8168

11718

1

Q.

And we would know from looking at that classified document,

2

how we know that insurgents in Afghanistan have recovered several

3

Warlock systems?

4

A.

Yes.

5

Q.

That would be some intelligence that was gathered from the

6

JWICS system or from some other source that the author referenced?

7

A.

Yes.

8

Q.

Or it could have been something that the external

9

coordination added to the document as well, correct?

10

A.

Yes.

11

Q.

Okay.

12
13
14
15

I'm going to remove Page 11.

Now, would you agree

with me that this document, there are over 50 end notes?
A.
document.
Q.

I'm not exactly sure how many end notes was in the
I can't remember.
Okay.

I'm going to hand the witness what's been marked as

16

Prosecution Exhibit 45.

If you would please, ma’am, just take a look

17

at that and just let us know how many end notes there are?

18

A.

Fifty-five end notes.

19

Q.

I'm going to retrieve the exhibit from the witness.

So

20

within this document there are facts or pieces of intelligence that

21

we -- the government had verified?

22
23

A.

That's how we know it, correct?

There’s 55 pieces of information of end notes that list

sources.

8169

11719

1
2
3

Q.

Would you agree with me that if we had a source for

something it would be listed?
A.

If there was a source for something in that document, if

4

the analyst found it, it would be listed; but that does not mean that

5

the analyst did not find all the sources.

6

Q.

Okay.

7

MJ:

Wait a minute.

8
9

find all the sources?
WIT: Okay.

That does not mean that the analyst did not

I don't understand that.

So let's say an analyst is writing product and some

10

sources have not been published yet.

11

when he wrote that product would not have all of the sources for that

12

document, but he will write the documents based on the sources that

13

he has available.

14
15

Q.

So there might be some intelligence out there that he just

hasn't seen yet?

16

A.

Yes.

17

Q.

Okay.

18

So, therefore, that analyst

And he wouldn't -- he wouldn’t obviously incorporate

that into the document?

19

A.

No, because he has not seen it?

20

Q.

It would be impossible to incorporate it?

21

A.

Yes.

22

Q.

Okay.

23

Thank you.

Now, ma’am, I'm going to publish Page 20

and I'd like to focus on the one of the areas in the template called

8170

11720

1

intelligence gaps.

Ma'am, you would agree with me that an

2

intelligence gap is something that we don't know, correct?

3

A.

Not always.

4

Q.

Not always, okay.

5

You would agree with me that it's

something that we -- a gap is there's something missing, correct?

6

A.

Not always.

7

Q.

What is a gap?

8

A.

Sometimes a gap could be information that we cannot

9

confirm.

10

Q.

Okay.

11

A.

We know it, but we can't confirm that it's actually true.

12

Q.

Okay.

And you would agree with me that in cases where you

13

know something you would cite it, correct, you would cite a source

14

for it?

15

A.

If you know it you cite the source for it, correct?
If the source can confirm it -- we can know something but

16

we can't confirm it.

17

it's not -- it's not corroborated.

18
19

Q.

So we cannot put it in the document because

When you say you can't confirm it, you mean you don't

really know, you can't say for sure that you know this?

20

A.

I can't say for sure that I know it.

21

Q.

Okay, and if you had even any sort of source or

22

intelligence you would have -- would you cite that in the document,

8171

11721

1

correct?

You wouldn't have a source for something and then just

2

leave that source out, right?

3

A.

If I can't confirm the source, yes, I would leave it out.

4

Q.

Because you can't confirm it?

5

A.

That’s correct.

6

Q.

You don't know for sure?

7

A.

8
9
10
11
12
13

Not necessarily that I don't know for sure.

I cannot not

confirm the source is accurate.
Q.

Okay.

Well, if you knew for sure, you would put the source

in there, right?
A.

If the source is verified, yes, I would put the information

in there.
Q.

Okay.

Now, I want to talk about these intelligence gaps.

14

I'd like to direct your attention to the third one.

You'd agree with

15

me that this says, ‘Would the WikiLeaks.org website be used by FISS’,

16

that's Foreign Intelligence Services.

Is that correct?

17

A.

Yes.

18

Q.

Foreign military services, foreign insurgents, or

19

terrorists groups to collect sensitive or classified or U.S. Army

20

information posted to the WikiLeaks.org website.

21

intelligence gap, correct?

22

A.

Yes.

23

Q.

So that's something you can't confirm?

8172

That's listed as an

11722

1

A.

No, we can't confirm that.

2

Q.

And would you agree with me that there is no end note at

3

the end of that intelligence gap, correct?
A.

Intelligence gaps we don't put end notes on intelligence

6

Q.

Because you don't have sources for them?

7

A.

They're gaps.

8

Q.

There is not an end note, but there is a question mark,

4
5

9

gaps.

correct?

10

A.

Yes, there is.

11

Q.

Again, a question mark would indicate that it's something

12

that we are looking for the answer to, right?

13

A.

Something we can't confirm the answer to.

14

Q.

Okay.

15

intelligence gap section, correct?
A.

16
17
18

If we had the answer, it wouldn't be in the

If we can't confirm it then we put it in the intelligence

gaps.
ADC[CPT TOOMAN]:

Your Honor, I have no further questions.

19

I'm going to remove Page 20 of Prosecution Exhibit 45 and return that

20

to the court reporter.

Thank you, ma’am.

21

MJ: Redirect?

22

ATC[CPT OVERGAARD]: Yes, ma'am, just one moment, please.

23

8173

11723

REDIRECT EXAMINATION

1
2

Questions by the assistant trial counsel [CPT OVERGAARD]:
Q.

3

Hi, Mrs. Glenn.

So you started explaining about

4

intelligence gaps a little bit when defense asked you about it, but I

5

want to hear in your own words what is an intelligence gap?

6

A.

That is easier if I give you an example.

7

Q.

Okay.

8

A.

Let's say I look at an organization.

9

organization name.

I know the

I know that organization has five branches.

I

10

know four of the branch names, but the fifth branch I'm not exactly

11

sure what the name is.

12

based on their structure, but I cannot confirm if that's the actual

13

name.

14

I have an idea of what it could possibly be

That's an example, one example of an intel gap.
Q.

Okay.

Well, how about -- how about using the example that

15

defense pointed out.

16

that's an intelligence gap, what's confirmed and what needs

17

verification?

18

A.

What can be confirmed, or can you explain why

How does that work?

In this particular example we know that intelligence

19

organization and terrorist groups perform open source collection,

20

but we cannot confirm if they actually visit that site and looked at

21

the information.

22

ATC[CPT OVERGAARD]: Just one moment, please.

8174

11724

1

[There was a brief pause while the assistant trial counsel consulted

2

with the trial counsel.]
Q.

3
4

And then after the intelligence gaps, again, what does the

conclusion say starting with ‘in addition’?
A.

5

It says, ‘in addition, it must also be presumed that

6

foreign intelligence’ -- ‘foreign adversaries will review and assess

7

any DoD sensitive or classified information posted to the

8

WikiLeaks.org website’.
ATC [CPT OVERGAARD]:

9

Thank you.

10

MJ: And you are standing up because you want a final recross?

11

ADC[CPT TOOMAN]:

12

MJ:

13
14

too.

All right.

Yes, ma'am.
And I will give the government redirect there

Go ahead.
ADC[CPT TOOMAN]:

RECROSS-EXAMINATION

15
16
17

Thank you, Your Honor.

Questions by the assistant defense counsel [CPT TOOMAN]:
Q.

Now, ma’am, you said that an intelligence gap would be

18

something that we can't confirm.

19

intelligence gap would -- could also be something we have no idea

20

about?

21

A.

It could be.

22

Q.

It could be.

23

presuming something.

Okay.

You would agree that an

And you talked just now about

How do you define presume, ma'am?

8175

11725

1

A.

How do I define presume?

2

Q.

Uh, huh [indicating an affirmative response].

3

A.

That quote was based on historical analysis of what foreign
So, we know

4

intelligence services and terrorist organizations do.

5

they conduct open source intelligence and we know that they are

6

interested in classified and sensitive U.S. Government information.

7

So based on what we know they do, we presume that they will visit

8

that site if that information is posted there.
Q.

9
10

have ever gone to WikiLeaks.org?

11
12
13
14
15

But you have no intelligence that the enemy or those groups

A.

At that time -- during that timeframe we could not confirm

Q.

And you also couldn't say if they were going to go there in

it.

the future?
A.

We know that they do open source research.

We know they

16

have certain key words they use to search with, and we know if this

17

classified or sensitive government information, that information will

18

be reviewed and assessed.

19

Q.

And you presume that?

You ----

20

A.

We know that they visit websites.

21

Q.

You know they visit websites ----

22

A.

And collect information.

23

Q.

---- but you don't know they visit WikiLeaks?

8176

11726

1

A.

We cannot confirm that they didn't visit WikiLeaks.

2

Q.

You have no intelligence that suggests that they have ever

3
4
5
6

been to WikiLeaks at that time?
A.

We couldn't confirm it at that time that they visited

WikiLeaks.
Q.

And if you would, ma'am, please, you've explained that

7

conclusion, but what does just the word presume, what does that mean

8

to you, ma'am?

9

A.

Presume?

10

Q.

Presume.

11

A.

Presume to me means that we will -- presume means that we

12

think that they will visit that website.

13

ADC[CPT TOOMAN]:

14

MJ:

15

ATC[CPT OVERGAARD]: Yes, ma'am.

16

MJ:

17

ATC [CPT OVERGAARD]:

20

Thank you, ma'am.

Any final redirect?

And this is final.
Re-re-redirect, yes, ma’am, thank you.
REDIRECT EXAMINATION

18
19

Okay.

Q.

All right.

You said on cross you could not confirm enemies

saw WikiLeaks in 2008?

21

A.

In 2008 we could not.

22

Q.

How about in 2009?

23

A.

In 2009, we could not.

8177

11727

1

Q.

And how about in 2010?

2

A.

In 2010, we could.

3

ATC[CPT OVERGAARD]: Thank you.

4

MJ:

5

WIT: Yes, ma'am.

I just have one question for you too.

EXAMINATION BY THE COURT-MARTIAL

6
7
8
9

Questions by the military judge:
Q.

You talked about the three different ways that reports are

generated.

10

A.

Yes.

11

Q.

The self-initiate have had versus the RFI versus the, I

12

forgot what you called it.

13

A.

Induction requirement.

14

Q.

Okay.

15
16

In terms of frequency, how frequently are self-

initiated reports generated versus the other two?
A.

No, they're not.

Are they unusual?

They're common. Self-initiated -- based

17

on our mission statement we identify, you know, threats to the United

18

States Army counterintelligence threats to the United States Army.

19

So we are always looking for threats to the United States Army.

20

self-initiate the products are produced often within our

21

organization.

22

MJ:

23

ATC[CPT OVERGAARD]: No, ma'am.

Any follow-up questions based on mine?

8178

So

11728

1

ADC[CPT TOOMAN]:

No, ma'am.

2

MJ:

3

ATC[CPT OVERGAARD]: Temporary, ma’am.

Temporary or permanent excusal?

4

[The witness was temporarily excused, duly warned, and withdrew from

5

the courtroom.]

6
7

MJ:

Is there any further evidence either side want to put on

the today?

8

TC[MAJ FEIN]:

9

MJ:

No, ma'am.

All right.

10

CDC[MR. COOMBS]:

11

MJ:

Before we -- oh, yes?
No, Your Honor.

Before we recess the Court I do want to go over a timeline

12

for deciding today's issues on objections for Prosecution Exhibits

13

31, 32, and 109.

14

Government, what's the relevance of these what hearsay, non-hearsay

15

purpose.

16

issue up if you will, on the table.

17

government file first and then you file next.

18

gist of what they're bringing in.

19

they create something knew, then we can address it there.

20

I would like the parties to put in writing,

Defense, I mean, we sort of put the issue -- we’ve teed the
I'm not going to have the
I think you have the

You can have an oral argument if

I understand we've had a busy week and you all are bringing

21

in witnesses and doing that.

If we take a little bit of time to file

22

these briefs and for me to rule, are these exhibits going to be

8179

11729

1

introduced with any other witnesses that are coming in tomorrow or

2

the next day?

3

ATC[CPT MORROW]:

4

MJ:

5
6
7
8
9

All right.

No, Your Honor.
So, what's the window of time then that we're

looking at before we have to have that issue resolved?
ATC[CPT MORROW]: I believe the end of the week, you know, is
probably sufficient to get this resolved.
MJ:

Okay.

What is a reasonable timeline in light of your

schedules with witnesses and preparation and getting everybody here

10

without delaying the proceedings to be able to come up with these

11

filings?

12
13
14
15

TC[MAJ FEIN]:

We'll have it by COB on Thursday.
MJ:

So, you are going to have this on COB on Friday, and you

want me to rule by the end of the week.

16

TC[MAJ FEIN]:

17

MJ:

18

TC[MAJ FEIN]:

19
20

Your Honor, the United States would offer 3 days.

COB Thursday.

COB Thursday and you want me to rule Friday morning?
Very short and concise, brief.

earlier, ma'am.
MJ: How about COB Wednesday.

21

TC[MAJ FEIN]:

22

MJ:

Yes, ma'am.

Can you do that?

8180

We can go

11730

1
2
3
4

CDC[MR. COOMBS]:
are in court.

We are at a disadvantage because all of us

The government has other counsel that can prep this.

MJ: If you get it to me by the end of the week and I rule on
Monday, will that work?

5

CDC[MR. COOMBS]: That can work, ma’am.

6

ATC[CPT MORROW]:

Yes, ma'am, when I said the end of the week,

7

Your Honor, I actually meant that I thought that it could be

8

submitted by the end of the week and then ruled on ----

9

MJ:

The following week?

10

ATC[CPT MORROW]:

11

MJ:

Yes.

So we submit it on COB on Thursday.

Does that work?

12

way if there's any issues we can address it on it Friday?

13

looking at COB Friday?

14

CDC[MR. COOMBS:

15

TC[MAJ FEIN]:

16

MJ:

17

TC[MAJ FEIN]:

18

CDC[MR. COOMBS]:

19

That

Or are you

We were looking at COB Friday, ma’am.
Friday, ma’am.

Or are you looking at COB Saturday?

Saturday, ma’am.

Friday works, ma’am.
If you are giving me Saturday, I’ll take

One moment, Your Honor,

20

TC[MAJ FEIN]:

21

MJ:

All right.

Saturday is fine as well, ma’am.
We’ll go COB Saturday.

22

following week.

23

to me that you know of.

I will rule the

What I would ask though is you identify authorities
Can you get me the copies of whatever

8181

11731

1

authorities you have that are germane to this issue so I could at

2

least look at those earlier?

3

CDC[MR. COOMBS]:

4

MJ:

All right.

Yes, ma'am.

I'll get those to you tonight.

Government, same thing if you know of any

5

authorities that support your case, get them to me as soon as you can

6

and I'll expect your briefs then on Saturday and will rule next week.

7

TC[MAJ FEIN]:

8

ADC[CPT TOOMAN]:

9

Yes, ma'am.
Would you like hard copy

or e-mail, or electronic, what’s your preference?

10

MJ:

11

ADC[CPT TOOMAN]:

12

MJ:

13

Ma’am, I’m sorry.

I would like both.

Thank you.

Happy to do it, ma’am.
Is there anything else we need to address

today?

14

TC[MAJ FEIN]: No, ma'am.

15

CDC[MR. COOMBS]: Nothing from the defense, Your Honor.

16

MJ:

17

CDC[MR. COOMBS]:

Yes, ma'am.

18

ATC[CPT MORROW]:

With -- I just want clarification, with

Start same time tomorrow.

19

respect to that authority are you speaking specifically to the

20

Internet archive or Twitter.

21

MJ:

No.

I'm speaking legal authority.

22

8182

They cited to me cases.

11732

1

ATC[CPT MORROW]:

Yes, related to the Internet archive,

2

related to the authentication of the information of the Internet

3

archive.

4

MJ:

If you have any authority that is germane to this motion or

5

any of the three objections.

6

authentication, and relevance that you want me to -- or that you

7

already have that you want me to consider, I would appreciate it in

8

advance.

9

I believe they were hearsay,

More time is always better for me.

ATC[CPT MORROW]:

10

MJ:

11

ADC [CPT TOOMAN]: No, ma'am.

12

TC[MAJ FEIN]:

13

MJ:

14

All right.

Yes, ma'am.
Is there anything else we need to address?

No, ma'am.

The Court is in recess.

[The court-martial recessed at 1656, 10 June 2013.]

8183

11733

1
2
3
4

[The court-martial was called to order at 0935, 11 June 2013.]
MJ:

Court is called to order.

Major Fein, please account for

the parties.
TC[MAJ FEIN]:

Yes, ma'am.

Your Honor, all parties when the

5

Court last recessed are again present, with the following exceptions:

6

Captain Overgaard and Captain Morrow are absent.

7

is present.

8
9
10

MJ:

Captain von Elten

Is the Government -- Well are there any issues we need to

address before we proceed?
TC[MAJ FEIN]:

Yes, ma'am.

A few admin issues.

First, this

11

morning United States filed what's been marked as Appellate Exhibit

12

566, the witness list order and proposed PEs, for the prosecution

13

witnesses.

That's an updated listing from the previous.

14

MJ:

All right.

15

TC[MAJ FEIN]:

Thank you.
Also, ma'am, as of 0930 this morning there are 11

16

members of the media at the media operations center.

There are two

17

stenographers.

18

trailer is available and the courtroom is not filled to capacity.

There's no one presently in the trailer, although the

19

MJ:

All right.

20

CDC[MR. COOMBS]:

Thank you very much.
Ma'am, I would like to put on the record

21

that the government has indicated pretty much from this day forward

22

they'll accommodate the request of the stenographers to have one come

23

in the morning, one come in the afternoon session, and that also the

8184

11734

1

stenographers will be given a dedicated pass for the media operations

2

center.

3

MJ:

Is that correct?

4

TC[MAJ FEIN]:

Yes, ma'am.

But also, the United States'

5

understanding is that the Court -- or the Court's preference or

6

directive is that one of the 70 spots for the media will actually

7

become 69 spots and a stenographer will be the 70th spot, so it will

8

actually not be a media spot, it will be the stenographer position.

9

That way the Public Affairs will credential off 69 positions, not 70.

10
11

MJ:

That is actually what I did direct you to do.

objection to that?

12

CDC[MR. COOMBS]:

13

MJ:

14

CDC[MR. COOMBS]:

15

TC[MAJ FEIN]:

16

MJ:

17

TC[MAJ FEIN]:

All right.

All right.

18

stipulations.

19

MJ:

20

TC[MAJ FEIN]:

No objection, Your Honor.
Anything else we need to address?
No, Your Honor.

No, ma'am.
Please call your next witness.
Ma'am, prior to that we're going to read two

Can you tell me who those are?
Yes, ma'am. Ma'am, the first stipulation is Mr.

21

Peter Artale, Prosecution Exhibit 70.

22

Chamberlin, Prosecution Exhibit 71.

23

Any

MJ:

Thank you.

8185

The next is Mr. Sean

11735

1

TC[MAJ FEIN]:

Your Honor, Stipulation of Expected Testimony of

2

Mr. Peter Artale, dated 9 June 3013.

3

Accused, Defense Counsel, and Trial Counsel, that if Mr. Peter.

4

Artale were present to testify during the merits and pre-sentencing

5

phases of this court-martial, he would testify substantially as

6

follows:

7

It is hereby agreed by the

I am currently employed by the Army Counter-Intelligence

8

Center, ACIC, with the 902nd Military Intelligence Group on Fort

9

Meade, Maryland.

ACIC produces finished intelligence products for

10

the Intelligence community.

11

fulfilling requests for information from the Army.

12

products and disseminates them on SIPRNET and JWICS.

13

Developer and the Team Lead of a team of three software developers.

14

I have worked in this capacity and for ACIC for 8 years.

15

this position, I worked in web development for the Defense

16

Intelligence Agency, DIA, for 1 year, then with Booz Allen for a 1-

17

year contract with National Geo-Spatial Agency.

18

Development Engineer and Programmer in the Air Force for 21 years.

19

retired from the Air Force as a Master Sergeant. I also have an

20

Associate's degree in Computer Science.

21

It often produces these products by
It takes finished
I am a Web

Prior to

I was a Software
I

I first became involved in this case on approximately 17

22

March 2010, after my Branch Chief, Ms. Jessica Johnson, alerted me to

23

the compromise of U.S. Government information.

8186

Ms. Johnson asked if

11736

1

I could use our system to see who had viewed a certain product.

2

could, as I had developed custom software to track access two

3

particular products.

4

by recording the Internet Protocol (IP) address and date/time of

5

access for each user who views our ACIC work product.

6

assigns a unique report key to the access event.

7

before we were contacted by law enforcement in this case, as ACIC was

8

notified of the compromise of one of our products in March 2010.

9

I

This software captures the viewer credentials

It then

This occurred

An IP address is part of the Transmission Control

10

Protocol/Internet Protocol (TCP/IP).

A protocol is the standard

11

language used to communicate over a network.

12

common "language" that computers use to communicate over the Internet

13

and so an IP address is the method of identifying a specific computer

14

on a network.

15

address at one time.

16

computer on a given network used our products.

17

custom product which, in capturing this user and access information,

18

produces metrics which can be used to see which of our products are

19

most popular and how our products are used.

20

views of the document in the ".asp" format which is the standard way

21

the product would appear on the website. ".asp" is a common file

22

format for web pages.

23

of the web version of the document and not the views of the ".pdf" or

TCP/IP is the most

Only one computer can be assigned a specific IP
Knowing an IP address allows us to know which
Our software is a

The software only logged

This means that the software only logged views

8187

11737

1

".doc" versions of the document.

2

whether the document was printed or saved, nor do they indicate how

3

long an individual looked at the document, if at all.

4

this data normally so we can analyze it to see where we need to

5

allocate our development and maintenance resource -- resources to

6

best support our internal and external customers.

7

produced by the tracking software is, therefore, called metrics.

8

The metrics are pulled when an engineer runs a certain

9

query.

Likewise, the logs do not indicate

We collect

The information

These queries can be customized to pull only the information

10

the developer wants to see.

11

interested in tracking every access to a product called -- excused

12

me, titled "WikiLeaks.org-An Online Reference to Foreign Intelligence

13

Services, Insurgents, or Terrorists Groups."

14

the product by determining and searching for its product

15

identification number, which is "RB08-0617".

16

identification number, which is on the document itself and assigned

17

internally by ACIC, is a identifier unique to each ACIC product.

18

In this case, we were specifically

Therefore, I searched

The product

This ACIC product "WikiLeaks.org An Online Reference to

19

Foreign Intelligence Services, Insurgents, or Terrorists Groups" is

20

housed on our website at "acic.north-inscom.army.smil.mil" and is

21

accessible only via a classified network, such as SIPRNET.

22

custom query, by IP address and visit time, to see every time this

23

particular document wrote, or was pulled from the web server.

8188

I wrote a

A

11738

1

custom query is a method of pulling information from a database.

I

2

pulled these metrics from my own workstation.

3

automatically pulled into a Structured Query Language (SQL) table.

4

SQL is a computer language for extracting and inserting information

5

in a database.

6

databases.

7

in that it has columns and rows; however, it is not as easy to search

8

and organize as an Excel spreadsheet.

9

and pasted the information from the SQL table into an Excel

The data is

It is a standard computer language to interact with

Printouts of SQL queries look like an Excel spreadsheet

I, therefore, digitally cut

10

spreadsheet and saved the data to my desktop.

I then organized the

11

spreadsheets in two separate manners.

12

visit date.

13

date.

14

searching for the data, moving it from the SQL table to the Excel

15

spreadsheet, or while in the Excel spreadsheet.

16

information and organized it in two separate manners because it was

17

easier to read.

18

ACIC as requested.

19

only accessible to the other three web developers on my team.

20

no reason to believe anyone else would have modified the logs in any

21

way.

22

involved in this case, as ACIC was notified of the compromise of one

23

of our products in March 2010.

The first set is organized by

The second is organized by IP address and then visit

I did not alter the content of the data in any way when

I moved the

I then emailed the metric data to my leadership at
The data is stored securely on our servers and is
I have

This occurred before we were contacted by investigators

8189

11739

In this case, the ACIC document concerned was posted in

1
2

2008.

I pulled the metric data tracking access to this document on

3

17 March 2010.

4

is 16 March 2010.

5

returned included views -- excuse me, Your Honor, view hits on the

6

document up until the morning I ran the data query.

7

broken down by record key, IP address, and visit date.

8

the metrics tell me the following about the user IP addresses who

9

opened the website containing the product with a product

The most recent access date listed in the metric data
The data returned included view -- The data

The logs are
Specifically,

10

identification number of RB-08-0617 in the web page format:

11

with the IP address 22.225.41.40 opened the web page on 1 December

12

2009, at 6:31 PM; a user with the IP address 22.225.41.40 opened the

13

web page on 29 December 2009, at 2:40 PM; a user with the IP address

14

22.225.41.40 opened the web page on 1 March 2010, at 6:40 PM; and a

15

user with the IP address 22.225.41.22 opened the web page on 7 March

16

2010, at

17

A user

11:31 PM.
The data for these metrics is collected by our custom

18

software automatically when someone clicks on one of our links to use

19

our ACIC work product.

20

Your Honor, the time, date, and IP address as well as which product

21

is being accessed and served out to the requester.

22

is accurate because there is no human intervention into the process

This system captures the date -- excuse me,

8190

We know this data

11740

1

and because views are logged using specific codes and for specific

2

products.
Finally, while it is possible to make manual insertions in

3
4

metric data output, those insertions cannot be backdated or

5

overwritten.

6

cannot itself be altered.

7

logs, I did not know to whom the IP addresses were attached or the

8

reasons for which the data was being pulled.

9

motivation nor knowledge required to alter the document.

This means whatever output data the system produces
Furthermore, at the time I pulled the

I had neither the
At no point

10

prior to pulling the metric log data, while pulling the information,

11

or after securing it, did I ever alter the data in any way.
My Branch Chief forwarded my email with these metrics to

12
13

Mr. Winston Budram, S-6 and Chief Information Officer of the 902nd MI

14

Group.

15

contacted our office.

16

the paper copy of these logs.

17

Identification is a printout of the complete logs that I pulled.

18

put the title "Views of ACIC Product RB08-06. -- or excuse me,

19

0617.asp" on the top of the Excel spreadsheet.

20

the ACIC product identification number and the format of the

21

document.

22

and organized by visit date.

23

logs that I pulled and organized by IP address and then visit date.

Mr. Budram forwarded the metrics to investigators after they
Prosecution Exhibit 63 for Identification is
Prosecution Exhibit 63 for
I

The title is based on

On the left side of every page are the logs that I pulled
On the right side of every page are the

8191

11741

1

I believe the information on the top of the page "Views of ACIC

2

Product RB08-0617.asp"; "Record Key"; "IP Address"; and "Visit Date",

3

which is the same as the title and heading information on the

4

spreadsheets that I pulled, was automatically produced by Excel when

5

the spreadsheets were printed.
I am the custodian of the records marked as PE 63 for ID

6
7

and an employee -- and an employee familiar with the manner and

8

process in which these records are created and maintained, by virtue

9

of my duties and responsibilities.

PE 63 for ID was made at or near

10

the time of the occurrences of the matters set forth by or from

11

information transmitted by, people with knowledge of these matters.

12

PE 63 for ID was kept in the course of regularly conducted business

13

activity.

14

make the records.

15

accurate, and complete copy of the original documents.

The records marked as PE 63 for ID are a true,

Your Honor, the United States moves to admit PE 63 for ID

16
17

It was the regular practice of the business activity to

as PE 63.

18

ADC[MAJ HURLEY]:

19

MJ:

20
21
22

All right.

it, please?

No objection, ma'am.
Prosecution Exhibit 63 is admitted.

May I see

Thank you.

TC[MAJ FEIN]:

Ma'am, Stipulation of Expected Testimony of Mr.

Sean Chamberlin dated 9 June 2013.

8192

11742

1

It is hereby agreed by the Accused, Defense Counsel, and

2

Trial Counsel, that if Mr. Sean Chamberlin were present to testify

3

during the merits and

4

he would testify substantially as follows:

5

pre-sentencing phases of this court-martial,

I am a Systems Administrator for the S-6 shop of the 902nd

6

Military Intelligence (MI) Group on Fort Meade, Maryland.

7

MI Group performs counterintelligence functions.

8

responsible for providing IT support for all unit servers.

9

capacity, I build new servers and maintain old ones.

The 902nd

My section is
In this

I have worked

10

in this capacity for 10 years.

11

military for 9 years and was a Staff Sergeant when I left the Army.

12

For the last 5 of my 9 years of active duty service, I had the

13

Military Occupational Specialty (MOS) of 33W, which is Inter -- which

14

is Intercept Electronic Warfare Systems Repair.

15

was a systems administrator.

16

received Security Plus training and have certifications in numerous

17

Microsoft server types.

18

Information Systems from the University of Phoenix.

19

Before that I was an active duty

In that capacity, I

To fulfill my current function, I have

I also hold a Bachelor's degree in

I first became involved in the present case in July of

20

2011, when my supervisor Mr. Robert Conner, the Site Lead for

21

Information Technology at the 902nd MI Group, requested that I pull

22

Microsoft Internet Information Services (MIIS) web server audit event

23

logs for the contacting IP addresses 22.225.41.22 and 22.225.41.40

8193

11743

1

between the dates November 2009 and May 2010.

2

logs that are specific to the web server.

3

the activity that occurs on the server and enable system

4

administrators like me to track what users do on the website.

5

logs contain data that is automatically written to them on a daily

6

basis.

7

from the United States Government computer assigned to the IP address

8

199.32.48.154, is a computer dedicated to processing classified

9

information at the Secret level.

10

MIIS are application

Audit logs are a record of

Audit

Here, the audit logs record file activity on a web server

This is the IP address for the ACIC

website on SIPRNET.
This data shows what IP addresses accessed our system

11
12

within that date range.

An IP address is part of the Transmission

13

Control Protocol/Internet Protocol (TCP/IP).

14

standard language used to communicate over a network.

15

most common "language" that computers use to communicate over the

16

Internet.

17

computer on a network.

A protocol is the
TCP/IP is the

An IP address is the method of identifying a specific

An IP address allows us to know which computer on a given

18
19

network accessed our server.

In this case, I pulled 18 log files for

20

the above IP address and date range.

21

following:

22

ex091221.log; ex091229.log; ex100207.log; ex100209.log; ex100211.log;

23

ex100214.log; ex100301.log; ex100302.og; ex100308.log; ex100315.log;

The files are named the

ex09119.log; ex091201.log; ex091214.log; ex091217.log;

8194

11744

1

ex100316.log; ex100317.log, which is the automatic naming convention

2

of Microsoft based on date.

3

files contain 86 entries for the IP address of 22.225.41.22 and 28

4

entries for the IP address of 22.225.41.40.

5

22.225.41.22 or 22.225.41.40 is 19 November 2010.

The files display in text format.

The

The first entry for

These logs are on our external web server, which is one of

6

The web server and the

7

the servers I am responsible for maintaining.

8

logs are located in what is commonly referred to as the "DMZ", which

9

is the area between our internal system and the SIPRNET.

I pulled

10

the data using a search window and searching the IP address for the

11

given date range.

12

addresses.

13

folder and had them burned to a disc.

14

that they were the logs that I pulled.

Then I searched for the two requested IP

I then put the files into an internal investigation
I looked at the disc to verify

I am familiar with these logs because of my work as a

15
16

systems administrator.

After I pulled the logs, they were burned

17

onto a rewritable disc by another individual.

18

contents of the disc to ensure it contained the logs I pulled.

19

disc labeled "Log Files 902nd MI 2011-0006" contain the logs that I

20

pulled.

21

disc.

22

Bates number: 00449439.

23

not alter the content of the logs in any way.

I reviewed the
The

Prosecution Exhibit 64 for Identification is a copy of this
I attested to the authenticity of these logs on 21 June 2012,
I pulled the logs from the server and did

8195

I have no reason to

11745

1

believe anyone else would have modified the logs in any way while

2

they are on the server as permissions to the "DMZ" are very limited.
Your Honor, the United States moves to admit Prosecution

3
4
5
6
7

Exhibit 64 for Identification as Prosecution Exhibit 64.
ADC[MAJ HURLEY]:

Ma'am, we have no objection to that; but may

I have a second to speak with Major Fein?
MJ:

Yes.

8

[There was a brief pause while the assistant defense counsel

9

consulted with the trial counsel.]

10

TC[MAJ FEIN]:

11

place recess.

12

MJ:

13
14

Go ahead.

Your Honor, the United States requests a brief in

I’m not actually recessing the Court.

going to let you do what you need to do.
TC[MAJ FEIN]:

Yes, ma'am.

15

[There was a brief pause while the assistant defense counsel

16

consulted with the trial counsel.]

17

I'm just

TC[MAJ FEIN]:

Ma'am, I have retrieved Prosecution Exhibit 64

18

and consulted with defense counsel and there has been one

19

modification to the Stipulation of Expected Testimony.

20

court reporter PE 64 and I would direct the Court to Page 2.

21

Honor, the top of Page 2 at the end of the first paragraph or the

22

first partial paragraph, the date 19 November 2010 has been modified

8196

I handed the
Your

11746

1

to say 19 November 2009, and the accused's, Major Hurley's and Major

2

Fein's initials are annotated on that change.

3
4

MJ:

All right.

Major Hurley, does the defense agree with this

change?

5

ADC[MAJ HURLEY]:

6

MJ:

7

ACC: Yes, Your Honor.

8

ATC[CPT von ELTEN]: Ma'am, the United States calls Matthew

9
10
11

Yes, ma'am.

PFC Manning?

Hosburgh.
MJ:

May I see Prosecution Exhibit 64?

admit that.

I think I still need to

Is that better done at a recess?

12

TC[MAJ FEIN]:

13

MJ:

Yes, ma'am, 64.

Prosecution Exhibit 64 for Identification is admitted.

14

Excuse me, Captain von Elten, who is the next witness?

15

ATC[CPT von ELTEN]: Matthew Hosburgh, ma’am.

16

STAFF SERGEANT MATTHEW HOSBURGH, U.S. Marine Corps Reserve, was

17

called as a witness for the prosecution, was sworn, and testified as

18

follows:
DIRECT EXAMINATION

19
20
21
22
23

Questions by the assistant trial counsel [CPT von ELTEN]:
Q.

For the record, you're Sergeant Matthew Hosburgh of Denver,

Colorado?
A.

Staff Sergeant, sir.

8197

11747

1

Q.

Where do you work?

2

A.

I'm currently working for an oil and gas company in Denver,

3

Colorado.

4

Q.

And what do you do there?

5

A.

I do their IT security.

6

Q.

And what does that entail?

7

A.

It entails monitoring the networks as well as threat and

8

vulnerability research.

9

Q.

And how long have you been in this position?

10

A.

I've been there for about 2 months now, sir.

11

Q.

And what was your position prior to that?

12

A.

Prior to that I was a government contractor where I did

13
14
15

basically the same type of work for citizenship and immigration.
Q.

And what department does citizenship and immigration fall

under?

16

A.

Department of Homeland Security.

17

Q.

And how long were you there?

18

A.

I was there for 3 years.

19

Q.

And how was the work similar; what did you do?

20

A.

Same type of thing, monitoring networks, looking for

21

threats, vulnerabilities and, yeah, that's basically it.

22

Q.

And what did you do prior to that?

23

A.

Prior to that I was on active duty in the Marine Corps.

8198

11748

1

Q.

And for how long were you on active duty?

2

A.

For 8 years.

3

Q.

What was your MOS in the Marine Corps?

4

A.

I was a 2651.

5

Q.

What is that?

6

A.

It's a Special Intelligence System Administrator.

7

Q.

What training did you receive in that position?

8

A.

I received numerous military schools as well as civilian IT

9
10
11
12
13

security related courses.
Q.

And what did those -- What kind of things did that

schooling teach you?
A.

Everything from system administration, servers, networks,

to security, basic security and things of that nature.

14

Q.

What kind of work did being a 2651 entail?

15

A.

Kind of ran the gamut as far as anything from, you know,

16

managing servers and network equipment to information assurance and

17

security accreditation and threat and vulnerability research.

18

Q.

What kind of systems did you work on?

19

A.

Worked primarily on classified network systems, servers and

20

networks of that nature.

21
22

8199

11749

1
2
3

Q.

And what kind of work did you do on those classified

systems?
A.

Managed the systems, provided access to our users as well
So we had to

4

as I was in charge of the security of those systems.

5

basically apply policy to those systems as well as manage the

6

vulnerabilities and risks that the systems faced.

7

Q.

What year did you leave active duty?

8

A.

2010.

9

Q.

What is your current military status?

10

A.

I'm a reservist.

11

Q.

When did you join the reserves?

12

A.

I joined in July of 2012.

13

Q.

What do you do in the reserves?

14

A.

I am a -- I have the same MOS so I do the same type of

15

general work, but I'm currently working as a network analysis or I'm

16

a network analyst.

17
18

Q.

Let's talk a little bit about a report you wrote.

were you stationed in late 2009 early 2010?

19

A.

I was in Stuttgart, Germany.

20

Q.

And what were you doing there?

21

A.

I had been stationed there, started out in 2006.

22

Q.

Do you remember attending a conference?

23

A.

Yes, sir.

8200

Where

11750

1

Q.

What was the conference called?

2

A.

It was, the title of the conference was called Here Be

3

Dragons.

4

Q.

And who hosted the conference?

5

A.

It was hosted by the Chaos Computer Club.

6

MJ:

What dragons?

7

WIT: Here Be Dragons.

8

Q.

How else is the Chaos Communication Congress known?

9

A.

It's either known as CCC or C3.

10

Q.

How did you know about C3?

11

A.

Through my research that I was doing just trying to stay

12

ahead of security threats, I noticed that the conference was

13

basically in our neck of the woods and that's how I found out about

14

it.

15

Q.

And where was the conference?

16

A.

It was in Berlin.

17

Q.

And when did the conference occur?

18

A.

It was roughly the 26th of December 2009, through the 30th,

19

if I remember correctly.

20

Q.

What is the C3 conference?

21

A.

So the C3 conference essentially, what it actually stands

22

for is the Chaos Communication Congress.

23

basically combines or brings together people throughout the hacker

8201

It's a conference that

11751

1

community, security researchers and just random people, brings them

2

all together and they talk about various topics ranging from

3

security, hacking, political issues.

4

probably there.

I mean you name it and it's

5

Q.

And how often is it held?

6

A.

It's held yearly.

7

Q.

And why did you attend?

8

A.

I attended, it was an opportunity to not only attend a

9

conference that could potentially I guess show some security

10

vulnerabilities that we might be able to apply to our command, but it

11

was also local and we had some extra funds to go travel and go to

12

that conference, so ----

13

Q.

How many days was the conference?

14

A.

I believe it was 5 days.

15

Q.

And how many days did you attend?

16

A.

I was there for 4 days.

17

Q.

How many people attended the conference?

18

A.

Roughly about 3 to 5,000 I believe.

19

Q.

What kind of facility hosted the conference?

20

A.

It was your standard just conference center, multiple rooms

21

One day was for travel.

that could host various talks and presentations.

22
23

8202

11752

1

Q.

And where were the featured presentations given?

2

A.

The featured presentations?

3

Those were reserved for the

bigger rooms of the conference center.

4

Q.

And about how big was the bigger room?

5

A.

How many people?

6

Q.

How many people did it seat?

7

A.

How many people?

8

Q.

500 to 1,000 people?

9

A.

I'm sorry.

10

Q.

What were some of the main presentations?

11

A.

Some of the main presentations I recall offhand they were

Okay.

Roughly maybe 5 to 1,000 people.

Yeah, 500, yes, sir.

12

talking about, one of the big ones was WikiLeaks, they talked about

13

Net Neutrality, Tor came up.

14

related to GSM cellphone networks.

15

off the top of my head.

They talked about various topics
A few others, I just can't recall

16

Q.

And what language were the talks given in?

17

A.

They were given in English and some of them were also in

18

German.

19

Q.

20
21
22

Let's talk a little bit about the Net Neutrality

presentation.
A.

How many speakers gave that presentation?

I recall I believe there was two speakers for that one.

One main presenter, though.

23

8203

11753

1

Q.

How long did the presentation last?

2

A.

That was about an hour if I remember that one right.

3

Q.

And what is Net Neutrality?

4

A.

Well, Net Neutrality, the way I see it is a way to keep the

5

Internet open and free as far as preventing any issues or ISPs,

6

Internet service providers from regulating it.

7

their whole talk was about we need to keep the Internet open and free

8

instead of having various tiers of regulation on the Internet.
Q.

9

So their issue or

And what was the purpose of the presentation?

10

ADC[MAJ HURLEY]:

11

MJ:

12

ATC[CPT von ELTEN]: Your Honor, I will ----

13

MJ:

14

ATC[CPT von ELTEN]: It goes to the effect on listener or on a

15

Objection, ma'am.

Hearsay.

Uhm ----

Establish a foundation and his personal knowledge.

document we are going to offer as evidence.

16

MJ:

17

ATC[CPT von ELTEN]: What was the purpose of the presentation?

18

MJ:

19
20

What was the question?

Ask for the foundation of knowledge.

that?
[END OF PAGE]

21

8204

How does he know

11754

1

Questions continued by the assistant trial counsel[CPT von ELTEN]:

2

Q.

How do you know that?

3

A.

How do I know what the purpose is?

Because there's a

4

summary of the talk before I went and I had done some research about

5

that topic.

6

Q.

And where did you do your research?

7

MJ:

Overruled.

8

Q.

Are where did you do your research?

9

A.

Research just on the open Internet.

10

Q.

And what was the purpose of the presentation?

11

A.

It was more about awareness, I remember that one.

It was

12

in English.

13

but specifically for some of the issues coming up in France at the

14

time.

15
16

The speaker was making a case for global open Internet,

ADC[MAJ HURLEY]:

Again, ma'am, hearsay.

He's just repeating

what the presenter told him.

17

MJ:

18

ATC[CPT von ELTEN]: I'm offering it for, it goes to explain why

19
20
21

What are you offering it for?

he wrote his report.
MJ: Overruled.
[END OF PAGE]

22

8205

11755

1
2
3

Questions continued by the assistant trial counsel [CPT von ELTEN]:
Q.

Let's talk about the WikiLeaks presentation.

What room was

that in?

4

A.

It was in one of the larger conference rooms.

5

Q.

About how many people attended the talk?

6

A.

That one was probably closer to 1,000.

7

pretty full.

8

Q.

Who gave the talk?

9

A.

The talk was given by Julian Assange.

10

Q.

And how long did Mr. Assange speak?

11

A.

It was about an hour or so.

12

Q.

And how was the talk relevant to your work at the time in

13

the Marines?

14

A.

15

I remember it being

It was relevant in the sense that I worked with classified

information at the time.

16

Q.

And what was the purpose of the talk?

17

A.

The main purpose of the talk was really to explain what

18

WikiLeaks was and the launch of their, basically their new site is

19

what I got from it.

20

then basically what the system provided.

They talked about what their intentions were and

21

Q.

And what were their intentions?

22

A.

The intentions were they basically were eliciting support

23

from the audience and then I guess anybody listening to the

8206

11756

1

conference to leak any type of information, not only classified

2

information but proprietary trade secrets, anything of that nature.

3

ATC[CPT von ELTEN]: I am retrieving Prosecution Exhibit 43 for

4

Identification, handing it to the witness.

5

Q.

Do you recognize the document I've handed you?

6

A.

Yes, sir.

7

Q.

What is it?

8

A.

This is my trip report, or after action report I wrote

9

after I came back from the conference.

10

Q.

When did you write it?

11

A.

I wrote it approximately a week after.

12

Q.

How do you know it's your report?

13

A.

Well, it has my name on it and it's in the format I'm used

15

Q.

Where did you submit it?

16

A.

Where did I submit it?

14

17
18

to.

I submitted it to basically my

chain of command when I got back.
ATC[CPT von ELTEN]: Retrieving Prosecution Exhibit 43 for

19

Identification from the witness.

20

I am handing Prosecution Exhibit 85 to the witness.

21

Q.

Retrieving Prosecution Exhibit 85.

Would you please take a minute to review Line 12?

I

22

believe it's on the second page.

23

[There was a brief pause while the witness reviewed the exhibit.]

8207

11757

1

A.

Okay.

2

Q.

How often were your reports posted online?

3

A.

How often were they posted?

Good question because we had

4

just implemented a new system, so we didn't really have a frequency

5

of necessarily posting them, a standard procedure for that.

6

that new system, it was kind of became a de facto practice of posted

7

after the trip.

Since

8

Q.

And where were they posted?

9

A.

We posted to a Sharepoint portal.

10

Q.

And what was the address of that Sharepoint portal?

11

A.

It was something along the lines of MFE.USMC.smil.mil.

And

12

then your various section be denoted by a G representing and then a

13

number.

14

Q.

Is that approximately the address listed in Line 12?

15

A.

Yes, sir.

16

ATC[CPT von ELTEN]: Retrieving Prosecution Exhibit 85.

Your

17

Honor, the United States would move to enter Prosecution Exhibit 43

18

for Identification into evidence.

19

ADC[MAJ HURLEY]:

20

MJ:

21

No objection, ma'am.

May I see it, please?

Prosecution Exhibit 43 for

Identification is admitted.

22
23

8208

11758

1
2
3
4

Questions continued by the assistant trial counsel [CPT von ELTEN]:
Q.

Let's talk a little bit about this report.

How did you

organize the report?
A.

I organized it basically chronologically so the talks I

5

went to, that's the first talk, and then so on and so forth

6

throughout the report.

7

Q.

What information did you put in the summary section?

8

A.

The summary was generally a description basically from the

9

conference itself, and then if there's anything I needed to add to

10

make it, to make it more -- to it make more sense to my chain of

11

command.

12

Q.

And what was, how did you construct the sections?

13

A.

The analysis was based off of some of the analytical work I

14

had done in our section and also trying to make that analysis fit

15

within our organization basically.

16

Q.

What was the purpose of the counter measure section?

17

A.

That was basically -- The purpose behind that was to

18

identify if there was a potential threat, security threat that maybe

19

we were vulnerable to, and then to see if we could actually fix it,

20

fix that vulnerability.

21

Q.

What was the purpose of drafting this report?

8209

11759

1

A.

To basically summarize the trip so I could show the command

2

actually what I did there, and then also to raise some awareness as

3

far as, you know, what the issues I found there were.

4
5

ATC[CPT von ELTEN]: Thank you.
Honor.

6

MJ:

7

ADC[MAJ HURLEY]: Yes, ma'am.

Cross-examination.

CROSS-EXAMINATION

8
9

No further questions, Your

Questions by the assistant defense counsel [MAJ HURLEY]:

10

Q.

Staff Sergeant Hosburgh, good morning.

11

A.

Good morning, sir.

12

Q.

When it comes to the document that you were just discussing

13

with Captain von Elten, that's a document that you wrote?

14

A.

Yes, sir.

15

Q.

By yourself?

16

A.

Yes, sir.

17

Q.

And it appears to be a reflection of your time spent at

18

this conference that you discussed with Captain von Elten?

19

A.

Yes, sir.

20

Q.

It was rendered chronologically?

21

A.

Yes, sir.

22

Q.

The first thing that you covered was net neutrality?

23

A.

Yes, sir.

8210

11760

1

Q.

Then WikiLeaks?

2

A.

Yes, sir.

3

Q.

Then you'll forgive my computer ignorance, exposing crypto

4

bugs through reverse engineering?

5

A.

Yes, sir.

6

Q.

And that was followed by some other more technical topics

7

of the conversation?

8

A.

Yes, sir.

9

Q.

And you started with Paragraph 1, as you were writing you

10

started with Paragraph 1?

11

A.

Yes, sir.

12

Q.

And you wrote your report chronologically as well?

13

A.

Chronologically, yes, sir.

14

Q.

In your discussion of Net Neutrality you mentioned

15

terrorist use of the Internet?

16

A.

Yes, sir.

17

Q.

And you mentioned that in Paragraph 1?

18

A.

Yes.

19

Q.

In your discussion of WikiLeaks you did not mention

20

terrorism or terrorist use of that site, correct?

21

A.

Correct, sir.

22

Q.

Now, let's talk about WikiLeaks; the presenter you said was

23

Julian Assange?

8211

11761

1

A.

Yes, sir.

2

Q.

And he did not mention terrorism in his presentation?

3

A.

Not that I can recall, sir.

4

Q.

Or a desire to help terrorists?

5

A.

No, sir.

6

Q.

That would have been reflected in your report?

7

A.

Yes, sir.

8

Q.

WikiLeaks was focused on the public and the public's access

9

to information?

10

A.

Yes, sir.

11

Q.

Ensuring openness?

12

A.

Yes, sir.

13

Q.

And keeping the public well informed?

14

A.

That's what he said, yes, sir.

15

Q.

And it wasn't exclusively focused on the United States?

16

A.

It wasn't.

17

They did mention, there was more of an emphasis

for classified information, however.

18

Q.

But it wasn't exclusively focused on classified

19

information?

20

A.

Correct, sir.

21

Q.

They were interested in trade secrets?

22

A.

Yes, sir.

23

Q.

And other corporate information?

8212

11762

1

A.

Yes.

2

Q.

So you mentioned, let's go back to that Paragraph 1,

3

terrorists and the use of the Internet.

4

terrorists use the Internet?

You indicated that

5

A.

Yes, sir.

6

Q.

To communicate with each other?

7

A.

Yes.

8

Q.

You indicated that an open Internet allows for hidden

9

communication?

10

A.

I believe I recall that, sir.

11

Q.

It's sort of a, you created this idea that an open network

12

allows for terrorist communication on the Internet.

13

A.

Yes, sir, I did.

14

Q.

Their communication with each other?

15

A.

Yes.

16

Q.

From one terrorist to another, and then potentially from

17

there to yet another terrorist?

18

A.

Yes, sir.

19

Q.

And the point as I understood it -- now, when there was a

20

discussion of Net Neutrality, did the individual giving the Net

21

Neutrality talk discuss terrorism?

22

A.

No, sir.

That was more of an analytical piece.

8213

11763

1
2
3
4

Q.

Right.

And what you were trying to show in your analysis

was essentially a cost benefit, right?
A.

Trying to show that if it was open, that communication

could still exist, yes, sir.

5

MJ:

6

WIT: Communication between the terrorists.

7
8
9

What communication?
Generally speaking,

that's a very general term.
Q.

Right.

And your point was that applying filters to the

Internet to make it less unneutral, to use that expression, that

10

would -- you benefit what you get from it with limiting terrorist

11

communication against the costs associated with making it less

12

neutral?

13

A.

Not necessarily a cost in my mind.

14

costs.

15

just find another communication medium.

16
17

Q.

They did talk about

It was more along the lines of if it's so restricted, they'll

And in your report you did mention that that, this making

the net less neutral would cost money?

18

A.

Yes, sir.

19

Q.

And you indicated also in your report that there would be

20
21

the potential for it impinging on the free flow of speech?
A.

Yes, sir.

8214

11764

Q.

1

In your report what you didn't say is that terrorists used

2

the Internet to gather information.

3

report?

4

A.

Not specifically, but maybe more I was implying that, yes,

Q.

And you didn't say that they used the Internet to gather

5
6
7

Is that idea reflected in your

sir.

information from open source reporting?

8

A.

Not specifically.

9

Q.

And you didn't say that they used the Internet or they use

10

any specific website for this open source collection?

11

A.

Correct.

12

Q.

The thrust of your point as you were talking about Net

13

Neutrality was terrorists and hiding their communication on the

14

Internet?

15

A.

Yes, sir, generally.

16

Q.

You were, uhm, You were involved in military intelligence

17

while you were on active duty in the Marine Corps?

18

A.

Yes, sir.

19

Q.

And how long were you an Intel NCO when you were in the

20

Marine Corps?

21

A.

Approximately about 3 years.

22

Q.

And you're familiar with the term intelligence gaps?

23

A.

Yes, sir.

8215

11765

1

Q.

And an intelligence gap is something we don't know?

2

A.

More or less, yes, sir.

3

ADC[MAJ HURLEY]:

4

MJ:

5

ATC[CPT von ELTEN]: Nothing, ma'am.

6

MJ:

7

ATC[CPT von ELTEN]: Temporary.

No further questions, ma'am.

Redirect?

All right.

Temporary or permanent excusal?

8

[The witness was temporarily excused, duly warned, and withdrew from

9

the courtoom.]

10

MJ:

I do have a question for the government.

I'm looking at

11

exhibit list, I’m looking at Prosecution Exhibits 43 and 44, which

12

appear to be the same thing, one is redacted and one is not.

13

TC[MAJ FEIN]:

14

MJ:

15
16
17

Yes, ma'am.

I have only seen a motion for admission for Prosecution

Exhibit 43. Is that the intent?
TC[MAJ FEIN]:

The intent was to use it as a substitute, yes,

ma'am.

18

MJ:

Okay.

19

TC[MAJ FEIN]:

Ma'am, the Stipulation -- read a Stipulation of

20

Expected Testimony for Lieutenant Commander Thomas Hoskins, United

21

States Navy Reserve dated 10 June 2013.

22

MJ:

What exhibit is that?

8216

11766

1
2

TC[MAJ FEIN]:

Yes, ma'am.

This is Prosecution Exhibit 111

Bravo, the unclassified redacted version.

3

It is hereby agreed by the Accused, Defense Counsel, and

4

Trial Counsel, that if Lieutenant Commander Thomas Hoskins, United

5

States Naval Reserve, were present to testify during the merits and

6

pre-sentencing phases of this court-martial, he would testify

7

substantially as follows:
I am a Lieutenant Commander in the United States Navy

8
9

Reserves.

I am a Reservist.

I am currently assigned to United

10

States Pacific Fleet.

In 1997, I obtained a Bachelors of Science in

11

Marine Transportation and a BS in Environmental Science from the

12

Massachusetts Maritime Academy.

13

Business Administration from the Naval Postgraduate School.

In 2007, I obtained a Masters of

I entered active duty in the United States Navy in 1998 and

14

While I was on active duty, I was an F-18

15

left active duty in 2009.

16

pilot.

17

logged over 1700 hours as a pilot, to include approximately 320 hours

18

of combat flight time.

19

include 6 weeks of ground school; 1 year of primary training for

20

preliminary flight instruction; 1 year of specialty training after I

21

selected intermediate training; and 8 months of advanced training in

22

weapons, formation flying, and carrier landing.

23

that training, I was selected to fly F-18s and received my wings.

I joined

the United States Navy Reserves in 2009. I have

I have completed the requisite training, to

8217

After completing

11767

1

Thereafter, I completed 1 year of F-18 training where I received

2

additional training in weapons usage, high and low level deployment

3

of bombs, and carrier flying.

4

division combat lead.

5

Afghanistan and conducted reconnaissance while deployed in Iraq.

6

have deployed three times in 2001 through 2002, 2003, 2004, and 2008,

7

and in support of Operation Enduring Freedom and Operation Iraqi

8

Freedom.

9

As a pilot, I have served as an F-18

I have operated weapons while deployed in
I

I have also served as a flight instructor for 3 years.
As a reservist, I currently work on planning, which

10

involves concept plans, operations plans, and execution orders.

11

After leaving active duty in 2009, I began to work at Booz Allen as a

12

contractor.

13

Previously, I worked for Booz Allen on matters related to United

14

States Northern Command USNORTHCOM Maritime Division.

15

Booz Allen, I work on USNORTHCOM J-6 security cooperation.

16

work for the J-6, I work on security cooperation between the United

17

States and Mexico.

18

communications, computers, and information, C4I.

19

Today, I work as a maritime planner for Booz Allen.

Currently at
In my

Specifically, I work on command and control of

I have worked with classified information in my career with

20

Booz Allen and as an active duty and reservist pilot.

21

worked with classified information daily for flights, mission

22

planning, mission briefing, and certain information about the planes.

23

Previously, I worked with classified information in my work at Booz

8218

As a pilot, I

11768

1

Allen in the J-5 pertaining to homeland defense plans, and planning

2

and development of specific plans for maritime activities, to include

3

work with the United States Coast Guard.

4

one half hour PowerPoint training on classified procedures and spent

5

about an hour quarterly on training.

6

classification training.

7

my work; I have used the USNORTHCOM classification guide to determine

8

the classification status of the information.

9

following when making any determination:

I have received a one and

I have received derivative

I have also used classification guides in

One:

I did not consider the
What, if any, of this

10

material was included in open source reporting and; two, what, if

11

any, of this material was available in unclassified publications,

12

such as Army Regulations or Field Manuals.
In 2001, I was mobilized to United States Central Command,

13
14

USCENTCOM.

15

While in this position, I worked on country-to-country action plans

16

and worked with the United States Embassy in Yemen and the Yemeni

17

military on plans and security cooperation.

I was mobilized to the J-5 planning office, Yemen Branch.

While mobilized at USCENTCOM, I was tasked through the

18
19

Tasking Management Tool to conduct a review for classified

20

information.

21

taskers.

22

submitted documents from the USCENTCOM JAG office.

The J-5 office plans through the director, who receives

The director passed the tasker to me.

8219

I received the
My assignment

11769

1

required me to determine whether the submitted documents contained

2

classified information at the time they were compromised.
In my capacity as the person tasked with reviewing the

3
4

submitted documents, I reviewed the documents for classified

5

USCENTCOM J-5 equities.

6

pertaining to United States v. Private First Class Bradley Manning,

7

which the prosecution provided to USCENTCOM.

8

by prosecution, submitted documents, included, among others,

9

documents from the Combined Information Data Network Exchange

I reviewed approximately 40 documents

The documents provided

10

Afghanistan, CIDNE-A, and other documents related to the AR I -

11

investigation of the Farah incident.

12

When conducting the review, I looked at USCENTCOM

13

classification guides and Executive Order 13526 and its predecessors.

14

I reviewed each submitted document line by line for classified

15

information by applying the USCENTCOM classification guides.

16

annotated the basis for each classification decision in my sworn

17

declaration dated 21 October 2011, Bates Numbers:

18

00527397.

19

declaration.

20

classification markings and were properly classified at least at the

21

Secret level, hereinafter "reviewed documents".

22
23

I

00527378 through

Prosecution Exhibit 87 for Identification is this
All documents noted in the declaration contained

Based on my military experience, I had prior familiarity
with the types of documents and information I reviewed.

8220

During my

11770

1

deployments, I worked with similar classified information pertaining

2

to mission planning, mission details, weapons systems, and maps of

3

troop locations.
The reviewed documents consisted of documents collected

4
5

from CIDNE-A and other documents related to the Farah investigation.

6

The reviewed documents contained military information, to include

7

military plans, weapons systems, or operations; significant activity

8

reports, SIGACT; operational code words when identified with mission

9

operations;

SIGACTs related to fact of and general type of

10

improvised explosive device (IED) attack on specific location on

11

specific date, which would have been known by the enemy that was the

12

subject of that report; participating units, and details of movements

13

of US friendly forces; concept of operations (CONOPS), Operation

14

Orders (OPORD), or Fragmentary Orders (FRAGOs); vulnerabilities or

15

capabilities of systems, installations, infrastructures, projects,

16

plans, or protection services relating to national security; and

17

limitations and vulnerabilities of US forces in combat area.

18

are properly classified as confidential upon execution and can be

19

declassified 1 year after completion.

20

types, vulnerabilities, locations, quantities, readiness status,

21

deployments, redeployments, and details of movement of U.S. and

22

friendly forces in operations can be properly declassified upon

23

execution.

8221

CONOPs

Participating units, including

11771

1

I reviewed and determined that 21 SIGACTs from CIDNE-A

2

contained classified information according to the classification

3

guides and my knowledge and experience.

4

reports from CIDNE-A were all marked as Secret.

5

from CIDNE-A contained multiple forms of military information, to

6

include information related to deployed -- deploying quick response

7

forces and code words, reported the effectiveness of IED attacks,

8

which would be known to the enemy that was the subject of those -- of

9

that report, report the locations of IED attacks, which would be

These reviewed SIGACT
The reviewed SIGACTs

10

known to the enemy that was the subject of that report, identified

11

IED tactics, techniques and procedures (TTPs) for responding to IED

12

attacks, identified TTPs for identifying and neutralizing IEDs,

13

friendly action reports of finding and clearing caches, weapons

14

systems and capabilities, sources and methods of Intelligence

15

engagement, rules of engagement, CONOPS, descriptions of United

16

States forces, TTPs for mission execution, anticipated enemy

17

reaction, flexible deterrent options, code words, assistance by

18

local foreign nationals in locating suspects, and details of enemy

19

attacks.

20

execution and can be declassified 1 year after completion.

21

Participating units, including types, vulnerabilities, locations,

22

quantities, readiness status, deployments, redeployments, and details

23

of movement of U.S. and friendly forces in operations can be properly

CONOPs are properly classified as Confidential upon

8222

11772

1

declassified upon execution.

The 21 CIDNE-A reports that contained

2

J-5 equities are located in Appellate Exhibit 501 and have been --

3

and have the Bates Numbers of 00377846 through 00377846 [sic] and

4

00377888 through 00377910.

5

within PE 89 for Identification.

These CIDNE-A reports are contained

Additionally, I reviewed the AR 15-6 investigation into a

6
7

military operation that occurred in Farah province, Afghanistan on or

8

about 4 May 2009.

9

was focused on investigating the circumstances surrounding a large-

The AR 15-6 investigation into the Farah incident

10

scale civilian casualties (CIVCAS) incident.

11

in Gharani, which is a village in Farah Province, Afghanistan.

12

noted in PE 90 for ID, I found that 13 of the Farah investigation

13

documents contained classified information I believed to be

14

sensitive and classified because the documents reveal TTPs, troop

15

movements, close air support, troops in combat (TIC), and graphics

16

showing troop movements.

17

contained J-5 Equities are located in AE 501 and have the Bates

18

numbers 00377425 through 00377480, 00377496, 00377627, 00377672

19

through 00377674, 0038029, 00378066, 00378071, 00378079, and

20

00378082.

21

The incident occurred
As

The Farah investigation documents that

These documents are contained within PE 90 for ID.
I reviewed PE 66 for ID, a CD contained the video named B -

22

- "BE22 PAX.wmv".

This video, Gharani video, is a video depicting

23

portions of a military operation in Farah Province, Afghanistan,

8223

11773

1

separately from the review I conducted for classified USCENTCOM J-5

2

equities.
While on active duty from 2007 through 2009, I was the

3
4

Strike Operations Officer responsible for planning, training, and

5

coordinating air wing and air-to-ground operations, which involved

6

coordinating with the Army ground liaison for mission coordination of

7

ground targets.

8

combat missions.

9

looking infrared radar (FLIR).

In this capacity I reviewed video recordings of
The videos captured flight operations using forward
I reviewed the videos to ensure the

10

mission achieved its goal, hit the target, or reviewed the

11

information captured in a reconnaissance capacity.

12

hundreds of these videos for validation.

13

similar to the hundreds of videos I reviewed as a strike operations

14

officer.

15

I reviewed

The Gharani video is

I reviewed the Gharani video for sensitive military

16

information.

I relied on my experience while conducting my review

17

for sensitive and classified information of the Gharani video.

18

particular, I relied on my training and schooling, experience as a

19

flight instructor, experience with operating FLIR systems, and

20

experience reviewing videos that record imagery as presented in the

21

FLIR System.

22

USCENTCOM J-5 equities, I forwarded my conclusions and

23

recommendations to Deputy Commander, USCENTCOM, an Original

In

After my review of the above referenced documents for

8224

11774

1

Classification Authority for his final determination as to whether

2

the information is properly classified.
Your Honor, the United States moves to admit Prosecution

3
4

Exhibit 87 for Identification as Prosecution Exhibit 87.

5

ADC[MAJ HURLEY]:

6

TC[MAJ FEIN]:

7

No objection, ma’am.

And the United States moves to admit Prosecution

Exhibit 66 for Identification as Prosecution Exhibit 66.

8

ADC[MAJ HURLEY]:

9

MJ:

All right.

No objection.
Both exhibits are admitted.

10

Prosecution Exhibit 66, please?

11

and 87 are admitted.

12
13

TC[MAJ FEIN]:

All right.

May I see

Prosecution Exhibits 66

Ma'am, the United States requests a brief comfort

break.

14

MJ:

All right.

15

ADC[MAJ HURLEY]:

16

MJ:

Any objection?
No, ma'am.

Court is in recess until 20 minutes to 11.

17

[The court-martial recessed at 1036, 11 June 2013.]

18

[The court-martial was called to order at 1047, 11 June 2013.]

19

MJ:

Court is called to order.

Let the record reflect all

20

parties present when the Court last recessed are again present in

21

court.

22
23

Is the government ready to call the next witness?

ATC[CPT von ELTEN]: Yes, ma'am.
recalls Special Agent Mander.

8225

United States calls -- or

11775

1

SPECIAL AGENT MARK MANDER, U.S. Army, was recalled as a witness for

2

the prosecution, was reminded he was still under oath, and testified

3

as follows:
DIRECT EXAMINATION

4
5

Questions by the assistant trial counsel [CPT von ELTEN]:

6

Q.

What is an IIR?

7

A.

An IIR, that's an acronym that stands for Intelligence

8

Information Report.

9

Q.

Who creates an IIR?

10

A.

Various military intelligence-like organizations throughout

11

DoD as well as other agencies that deal with intelligence typically

12

create them.

13

Q.

What are some examples of some of those agencies?

14

A.

Army Military Intelligence, I know the FBI creates them,

15

NCIS, Air Force Office of Special Investigations.

There's others.

16

Q.

What types of information do they contain?

17

A.

They contain all types of intelligence information relating

18

to counter terrorism information, things involving cyber activities,

19

as well as things about foreign militaries, things like that.

20

Q.

And who writes them?

21

A.

Typically individuals who are assigned in military

22

intelligence-like units or other intelligence type units that they

23

are designated to produce those types of reports.

8226

11776

1

Q.

What is the basis of the content in an IIR?

2

A.

The basis of the contents can be from sources, people that

3

provide information, it can be from other military or intelligence

4

organizations that actually observe activities for themselves and

5

they want to report it and that's essentially the mechanism the

6

intelligence community uses to share that information to other

7

elements.

8

Q.

And that leads me to, how are they used broadly?

9

A.

Well, there's a system, and I'm not super familiar with it

10

because I do criminal investigation, but generally speaking, someone

11

will produce a report that contains information or intelligence in

12

it.

13

generate questions or follow-up questions, which then in turn produce

14

more reports.

Other elements will then see that report and they can then

15

Q.

And how are they organized?

16

A.

Can you be more specific?

17

Q.

Is it like a fact summary, an analysis section, does it

19

A.

It probably varies.

20

information.

21

two pages, sometimes they're very long, multiple pages and they, you

22

know, are kind of organized in, they usually have across the top like

18

vary?
It depends on the nature of the

Sometimes they're very short, maybe like just one or

8227

11777

1

a classification, there will be like a section that shows the

2

distribution of who got the report.

3

ADC[CPT TOOMAN]:

Your Honor, we'll object based on personal

The witness has said he's not familiar -- super familiar

4

knowledge.

5

with, to use his words, with this process so we would object on

6

personal knowledge.

7
8
9
10

A.

I have seen many intelligence reports, but I don't know all

about the process of how they're created.
MJ:

All right.

they're created.

Then stop asking about the process of how

Sustained.

11

Q.

Where do you find IIRs?

12

A.

There's two systems that I would use to look up IIRs.

I

One of them is called Hot-

13

believe I can name the two systems here.

14

R, H-O-T-R, and I don't know what that acronym stands for or if it

15

stands for anything, and then there's another system called the Multi

16

Media Manager, or they typically call it M3.

17

others.

18

Q.

What are some of the others?

19

A.

I don't know the others, I just know that there are others

I know that there's

20

and that certain systems are based on like the organizations that

21

produce the reports. So, for example, the DoD reports, most of them

22

are in Hot-R, but if you want to see a report that was published by

23

another organization such as like the FBI, you would use M3.

8228

11778

1

Q.

What search engine do you use to search for IIRs?

2

A.

Intelink is one of the systems you can use to search.

3

Q.

Do you use Intelink to search for IIRs?

4

A.

Occasionally.

5

Typically you can also log into one of the

systems I mentioned and then search for the IIRs that way as well.

6

Q.

How are the results displayed in Intelink?

7

A.

They're typically displayed kind of similar to what Google

8

looks like, it’s somewhat similar.

9

Q.

And when have you used IIRs?

10

A.

Well, specifically in this case we did look for IIRs that

11
12
13

related to WikiLeaks, that keyword.
ATC[CPT von ELTEN]: Retrieving Prosecution Exhibit 99 for
Identification.

Handing it to the witness.

14

MJ:

15

ADC[CPT TOOMAN]:

16

ATC[ CPT von ELTEN]:

17

Q.

What have I handed you, Agent Mander?

18

A.

This appears to be an, excuse me, a declassified version of

19

Just a minute.

Yes.
Can I take a look at that?
I’m sorry.

an IIR specifically related to the WikiLeaks organization.

20

Q.

And what is it numbered?

21

A.

The number is IIR 5391001408.

22

Q.

And what is the numbering convention based on your

23

experience?

8229

11779

1

A.

The numbers are broken by spaces.

The first number, 5, I

2

believe that indicates the general organization such as Army, Navy,

3

Air Force.

4

the specific organization within that service.

5

excuse me, third set of numbers, it's a four digit number, 0014,

6

would be the serial number of the report.

7

numbers, 08, would be the year, the two digit year of the report.

8
9

Q.

The second number is a three digit number, 391, would be
The fourth set or,

And then the last two

Would you please take a moment to review the report?

[There was a brief pause while the witness reviewed the exhibit.]

10

A.

Okay.

11

Q.

What's an overview of the content?

12

A.

Generally speaking, the content of this IIR, it more or

13

less spells out that the WikiLeaks organization was established in

14

December 2006.

15

sensitive government and corporate documents.

16

organization as a uncensorable Wikipedia for untraceable mass

17

document leaking and analysis.

18

details as well as mentions a large number of what we call mirror

19

sites and it gives a long list of it.

Its point was to encourage the anonymous posting of

20

MJ:

21

ADC[CPT TOOMAN]:

22

It describes the

And it also goes through, gives more

Yes?
We'll object based on relevance,

Honor.

8230

Your

11780

ATC[CPT von ELTEN]: Your Honor, I'm just having him lay

1
2

foundation for the contents of the document, to authenticate it.

3

MJ: What's the relevance?

4

ATC[ CPT von ELTEN]:

5

MJ:

6

ATC[CPT von ELTEN]: I'm going to do that right now.

7

MJ:

8

ATC[CPT von ELTEN]: Sorry, ma'am. The relevance is this

9
10

The relevance of it?

Yes.

Well, why don’t you tell me.

document, we have evidence was searched for by PFC Manning on
Intelink.

11

MJ:

Overruled.

12

ATC[CPT von ELTEN]: Retrieving Prosecution Exhibit 99 for

13

Identification from the witness and handing the witness Prosecution

14

Exhibit 85.

15

MJ:

16

ATC[CPT von ELTEN]: Yes, ma'am.

17

MJ:

18

ATC[CPT von ELTEN]: I’m handing the witness Prosecution Exhibit

19

That's 99 for Identification, right?
Agent Mander ----

Just a minute.

85.

20

MJ:

For Identification?

21

ATC[CPT von ELTEN]: No, ma'am.

22

MJ:

It's admitted?

23

8231

11781

1

Questions continued by the assistant trial counsel [CPT von ELTEN]:

2

Q.

Please review Line 19.

3

MJ:

Stop there for just a moment.

I want to check with the

4

court reporter for the admissibility -- has Prosecution Exhibit 85

5

been admitted?

6

REPORTER: [Indicating an affirmative response.]

7

MJ:

Go ahead.

8

Q.

What was the -- Where was the search conducted reflected in

9
10

Line 19?
ADC[CPT TOOMAN]:

Your Honor, the defense is going to object.

11

I believe that this exhibit is computer logs.

12

expert.

13

can actually interpret the Intelink raw data.

This isn't a computer

The government hasn’t laid the foundation that this witness

14

MJ:

Lay a foundation.

15

Q.

Agent Mander, what is your position?

16

A.

I'm a special agent with the Army CID, specifically the

17

computer crime investigative unit.

18

Q.

And what type of computer crimes do you investigate?

19

A.

Generally speaking, we investigate network intrusion type

20

incidents.

21

Q.

Do you review computer logs as part of that work?

22

A.

Yes, we do.

23

Q.

And what is a log?

8232

11782

A.

1

A log file is basically a list of activity that is recorded

2

typically by a computer or other types of systems that show what

3

activities occurred.

4

Q.

And what kind of activities are recorded?

5

A.

Typically the accesses to a computer system or perhaps

6

maybe traffic that transits Internet device such as a router or

7

switch, things like that.

8

Q.

And how often do you review computer logs?

9

A.

I used to review them all the time.

10

Now not so much, but I

still see them fairly frequently.

11

Q.

And how familiar are you with computer logs?

12

A.

Fairly familiar.

13

MJ:

Overruled.

14

ADC[CPT TOOMAN]:

Your Honor, the defense would request the

15

opportunity to voir dire this witness about his knowledge of how

16

computer logs are created.
MJ:

17

All right.

I'll let you go ahead and do it.

Are you

18

finished laying the foundation or do you have more foundation for

19

him?

20

ATC[CPT von ELTEN]: Just a little more, ma'am.

21

MJ:

Go ahead.

22

Q.

What was the source identified in Line 19?

8233

11783

INSTRUCTIONS FOR PREPARING AND ARRANGING RECORD OF TRIAL
USE OF FORM - Use this form and MCM, 1984,
Appendix 14, will be used by the trial counsel and
the reporter as a guide to the preparation of the
record of trial in general and special court-martial
cases in which a verbatim record is prepared. Air
Force uses this form and departmental
instructions as a guide to the preparation of the
record of trial in general and special court-martial
cases in which a summarized record is authorized.
Army and Navy use DD Form 491 for records of
trial in general and special court-martial cases in
which a summarized record is authorized.
Inapplicable words of the printed text will be
deleted.

8. Matters submitted by the accused pursuant to
Article 60 (MCM, 1984, RCM 1105).

COPIES - See MCM, 1984, RCM 1103(g). The
convening authority may direct the preparation of
additional copies.

12. Advice of staff judge advocate or legal officer,
when prepared pursuant to Article 34 or otherwise.

ARRANGEMENT - When forwarded to the
appropriate Judge Advocate General or for judge
advocate review pursuant to Article 64(a), the
record will be arranged and bound with allied
papers in the sequence indicated below. Trial
counsel is responsible for arranging the record as
indicated, except that items 6, 7, and 15e will be
inserted by the convening or reviewing authority,
as appropriate, and items 10 and 14 will be
inserted by either trial counsel or the convening or
reviewing authority, whichever has custody of
them.

13. Requests by counsel and action of the
convening authority taken thereon (e.g., requests
concerning delay, witnesses and depositions).

1. Front cover and inside front cover (chronology
sheet) of DD Form 490.
2. Judge advocate's review pursuant to Article
64(a), if any.
3. Request of accused for appellate defense
counsel, or waiver/withdrawal of appellate rights,
if applicable.
4. Briefs of counsel submitted after trial, if any
(Article 38(c)).
5. DD Form 494, "Court-Martial Data Sheet."

9. DD Form 458, "Charge Sheet" (unless included
at the point of arraignment in the record).
10. Congressional inquiries and replies, if any.
11. DD Form 457, "Investigating Officer's Report,"
pursuant to Article 32, if such investigation was
conducted, followed by any other papers which
accompanied the charges when referred for trial,
unless included in the record of trial proper.

14. Records of former trials.
15. Record of trial in the following order:
a. Errata sheet, if any.
b. Index sheet with reverse side containing
receipt of accused or defense counsel for copy of
record or certificate in lieu of receipt.
c. Record of proceedings in court, including
Article 39(a) sessions, if any.
d. Authentication sheet, followed by certificate
of correction, if any.
e. Action of convening authority and, if appropriate, action of officer exercising general courtmartial jurisdiction.
f. Exhibits admitted in evidence.

6. Court-martial orders promulgating the result of
trial as to each accused, in 10 copies when the
record is verbatim and in 4 copies when it is
summarized.

g. Exhibits not received in evidence. The page
of the record of trial where each exhibit was
offered and rejected will be noted on the front of
each exhibit.

7. When required, signed recommendation of
staff judge advocate or legal officer, in duplicate,
together with all clemency papers, including
clemency recommendations by court members.

h. Appellate exhibits, such as proposed instructions, written offers of proof or preliminary
evidence (real or documentary), and briefs of
counsel submitted at trial.

DD FORM 490, MAY 2000

Inside of Back Cover

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh