Title: Gov Resp to AE 594, 11 Jul 13

Release Date: 2014-03-20

Text: UNITEDSTATESOF AMERICAProsecution ResponseV.Manning, Bradley E.PFC, U.S. Army,HHC, U.S. Army Garrison,Joint Base Myer-Henderson HallFort Myer, Virguiia 22211to Defense Motion forDirected Verdict: Article 10411 July 2013RELIEF SOUGHTThe prosecution in the above case respectfully requests the Court deny the defenserequest to enter afindingof not guilty as to the Specification of Charge I (pursuant to Rule forCourts-Martial (RCM) 917(a)).BUItDEN OF PERSUASION AND BURDEN OF PROOFA motion for afindingof not guilty shall be granted only in the absence of someevidence which, togetlier with all reasonable inferences and applicable presumptions, couldreasonably tend to establish every essential element of an offense most favorable to theprosecution, witli an evaluation of the credibility of witnesses. RCM 917(d).FACTSThe prosecution began its case in chief on 3 June 2013 and rested on 2 July 2013. Thedefensefiledits motions for directed verdict on 4 July 2013.WITNESSES/EVIDENCEPELOMPFPE 5: 35F Program of Instruction and Lesson PlanPE 6: 35F AIT Student Evaluation PlanPE I I : Hard drive - DN #073-10 Item 1 - Classified (Accused's Extemal Hard Drive)PE 12: Hard drive - DN #073-10 Item 1 - Classified (.22)PE25: Poweipoint "Operations Security" did 13 Jun 08PE 30: Wired.com chat logs (Manning/Laino)PE 35: Stipulation of Expected Testimony, Elisa Ivory, 10 May 13PE 36: Stipulation of Expected Testimony, SSG Alejandro Marin, 30 May 13PE 42: Readme.txtPE 43: Chaos Communication Congress report by SSG Matthew Hosburgh, dtd 7 Jan 2010(declassified)PE 45: ACIC Special Report, Wikileaks.org-an Online Reference to Foreign IntelligenceServices, Insurgents, or Terrorist Groups? (unclassified w/out references)PE 51: Power Point slides "Issue: Islamic Extremism"PE 52: Power Point shdes "Information Security AR 380-5" from 305th MI Battalion1APPELLATE EXHBIT C>C?0PAGE REFERENCED:PAGEOFPAGESPE 58: Email fiom Manning to Linesman and Hack, dtd 12JanlO-ClassifiedPE 59: MaimingNon-Disclosure Agreement witnesses by Rubin (aka Ivory), dtd7Apr 08PE 60: Maiming Non-Disclosure Agreement witnessed by Balonek, dtd I7Sep 08PE61:CD ContaininghitelinkLogs for .22and.40 ClassifiedPE63:ACICWebsiteLogsPE64:ACICWebseiverLogsPE 70: Stipulation ofExpectedTestimony,Mr.Peter ArtalePE85:Intelink Log Summary(C3 and NCIS Documents)PE99:NC1S^I1RPE 120: Buddy List fiom PFC Manning'sPeisonal Mac Listing Press Association ContactInfbmiationPEI23:Chats recovered fiom PFC Maiming'sPersonal Mac between Press Association anddaw^gnetworkPE 127: VoIumes.txtAE81:CourtRuling,DefMotionDismissTheSpofChf,FTSAO,26Aprl2AE410: Court's Draft InstructionsDEJ:ReportofExaminationofPFCMamiing'sPersonal Laptop ClassifiedTestimony of CPTFultonTestimony ofCW2 BalonekTestimony ofCW2 HackTestimony ofMr. HosburghTestimony of Mi . JohnsonTestimony ofMr.MadridTestimony ofMr.MoulTestimony ofSAManderTestimony ofSA ShaverTesthnonyofSA SmithTesthuonyofSFC AnicaEEGAEAUTHORITV AND ARGUMENTThe sole allegation in the defense's motion withregard to A^ticleI04 is that theprosecution did not present evidence thatthe accusedhad "actual knowledge" that by givinginforniation to WikiLeaks, he was giving infomnation to an enemy ofthe Unites States. DefenseRCM917Motionfi:^rAificIeI04atLOnly "some evidence which, together with all reasonable inferences and applicablepresumptions, could reasonablytend to establishevery essential element ofan offense charged"is necessary to withstandamotionforadiiected verdict. RCM9I7(c). The Coui^ shall viewfiieevidence "in the light most favorable to the prosecution, without an evaluation ofthe credibilityofwitnesses."7^.;.^^^^^^^^^^7^^^^^^^.^v.7^^^^^^, 40 M.L 373 (C.M.A. 1994) (upholdingthemilitary judge'sdecision not to enterafinding of not guilty because the testhnony ofthreewitnesses, constmed in the light most favorable to the prosecution, could reasonably tend toestablish the overt act). Courts agree the "some evidence" standard to surviveamotion forafinding ofnot guilty isalow one.^^^7^^^^^^^.^^^..^.^^^^^^^^^-^^^^^^^^^^,2013 WL 561356 (1^M.Ct.Ciim.App.2(^I3)(concuningwith the military judge who "noted repeatedly while healingargument on the RCM 9I7motion^that^the standard for surviving suchamotion is very low");.^^^^^.^^^^^7^^^^^^^.^^^..7^^^^^^^.^,59M.L 893,898(A.C.C.A.2004)(encouiagingtii^^view the standard used to decide whethertograntamotion fbrafinding of guilty asamirrorimageofthe standard used to decide whether to give an instruction on an affirmative defense);^^^^^^^^^^^.^v^^^^^^^^^^,1994WL7I1894(AFCt.CrimApp.l994)(qi^^^^(noting that "^t^hemilitai^^ judge was obviously correct in denying the motion fbrafinding ofnot guilty under the Iow,^some evidence'standard set out inRCM917(d)").According to the Court's drafi instructions forthe Specificafion ofCharge I,"knowii^gly"iequiiesactualknowledgebytheaccusedthatbygivingtheintelligence to the 3rd party or mtei^uediaiy or in some other indirect way,that hewas actually giving intelligence to the enemytluough this ii^diiect means. Thisoffense requires that the accused hadageneral evil intent in that the accused hadto know he was dealing, directly or indirectly,with an enemy of the United States.'I^iowingly'means to act voluntarily or deliberately. Apersoncannot violateArticleI04 by committing an act inadvertently,accidentally,ornegIigently thathas the effect ofaiding the enemy.Appellate Exlubit(AE)4I0at2;.^^^^^^.^^^^^^^^^^^^^^^.^.^^..^^^^^^^^^^^^1956). The explanation of'^iow^ledge" in Articlel04(c)(5)(c)fbr "Giving intelligence to theenemy" also states thaf'Actual knowledge is required but may be proved by circumstantialevidence." Article 104(c)(5)(c), Unifbim Code ofMilitai^ Justice (UCMJ). This definition isquoted in "The Law: Article 104" portion ofthe Court's Ruling on the Defense Motion toDismiss forFailure to State an Offense. AE81;.^^^^^.^^RCM918(c)(Findings may be basedon direct or circumstantial evidence.). "There is no general rule for detei^ining or comparingthe weight to be given to direct or circumstantial evidence." RCM918(c), discussion.Direct or circumstantial evidence satisfies the "some evidence" standard.United Statesv.Paikei,59M.L195(C.A.AF.2003);UnitedStatesv.Varkonyi,645F2d453,458 (5thCir1981). Although not explicitly enumerated in the drafi instruction of'knowingly" for Article104, in the draft instruction for "knowledge" in Specificationlof Charge II the Courtspecifically notes that,"I^now^Iedge, like any other fact, may be proved by circumstantialevidence, including the accused's training, experience, and militaiy occupational specialty." AE410at3.The prosecution elicitedaplethoia of evidence in its case in chiefto prove that theaccused had the requisite knowledge for the Specification of ChargeL The evidence that theprosecution presented to establish the accused's actual knowledge can be broadly defined underthree categories: (l)Militaryeducationandtraining; (2) inforniation the accused reviewedduring the course ofhis misconduct; and (3)statements by the accused.1. Military Education andTiainingThe defense acknowledged that the prosecution introduced evidence that, inhis training,the accused was instructed that the enemy uses the internet generally.Defense RCM917Motion at 2. The defense, how^ever, argues that the prosecution has not proffered any evidencethat shows that the accused yvas instructed thataparticular enemy looks at or uses the WikiLeakswebsite.Thepiosecutionnotesafactt^alinaccuiacyinpaiagraph5ofthedefense'sargument Inresponse to the defense in cross-examination, Mr.Johnson testified he did not look at or recoverany websites that were associated with tei^orism or withahatred of America or anti-Americanbehefs in his forensic examination ofthe accused's personal Macintosh computer,iatherthanwhat the defense proffered. Testimony ofMr.MarkJohnson. Mr.MarkJohnson did not say"that his forensic investigation ofPFC Manning's computerrevealed no searches for the enemy,anything related to terrorism, or anything remotely anti-American." Defense RCM 917Motionfi:^rArticlel04at2.a. AlTTiainin^The prosecution established in its case-in-chiefthat the accused is an allsouiceintelligence analyst (35F). ^^^^^.g^.,ProsecutionExhibit(PE)1(OMPF).The prosecution presented evidence that during AIT,the accused coimuitted anoperational securify(OPSEC) violation and, aspartofcorrective training, was specificallyrequired to research and biiefthe importance ofOPSEC and the potential damage or harm tonational security by having an OPSEC violation. ^^^Testimony ofMr. Madrid. Tlie accusedpresented tluee differentfypesof collective tiaining(abrief,aPower Point, andawrittenreport)that covered the importance ofOPSEC.^^^Testimony ofMr. Madrid; PE 25 (Power Pointpresented bythe accused on OPSEC). The accused's Power Point was found on his external harddrive, which was recovered fiom the Accused's CHU in Iraq.^^^TestimonyofSA Smith;Testimony ofMr.Jolmson; DEL In his Power Point, the accusednoted that, among others,adversaries included foreign govermnents,tei^orists, activists, and hackers. Testimony ofMr.Madrid; PE 25 (Power Pointpresented bythe accused on OPSEC). In his Power Point, theaccused also documented "Coimnon OPSEC Leaks" which included the Internet and concludedthat disclosure ofinformation, including posting on the Internet, must be avoided and that onemust use common sense because there are many enemies and it isafiee and open society. 7^.The prosecution also presented evidence on the accused's training as an all-sourceintelligence analyst and that training iiicluded training on the identities of tei^oristgioups,whichincluded Al-^aeda.^^^Testimony ofMr. Moul; PE5(35F Program oflnstiuction and LessonPlan); PE6(35FAITStudentEvaluationPlan);PE51 PowerPoint slides on theenemy).Theprosecution also presented evidence thatthe accused was trained that the enemyused the internetand that anything thatthe enemy can use or piece together to use againstthe United States shouldbe protected, in include, among other things,PII and unit identification and movementinformation. ^^^Testimony ofMr.Moul; PE5(35F Program oflnstiuction and Lesson Plan);PE6(35FAITStudentEvaluationPlan);PE51(PowerPoiirtslidesontheenemy);PE52(PowerPointslidesfiomAITonINFOSEC);PE36(Stipulationof,ExpectedTestimony,SSGMarin);PE35(StipulationofExpectedTestimony,Ms.Ivory).Forexample,sIide7Lwhichissupplemented by the text in the corresponding 35FAIT lesson plan, and was tauglitto theaccused by Mr. Moul states,"The enemy will attempt to discover how and when we areconducting operations, knowing this, we must protect our activities from detection.Wedo thisby: ^Identifying-Criticallnfbrmation^Analyzing-Thieat." ^^^PE 52 (Power Point slidesfiom AITonfNFOSEC);Testimony ofMr. Moul; PE5(35F Program oflnstiuction and LessonPlan). Slide 72 defines "Critical Information" as, among other things, installationmaps^ithhighlights ofdesigi^ated points ofinterest,SOPs, TTPs, unit capabilities and intent, andpeisonal^familyinfi^miafion 7^ Slide 73, entitled "PreventDisclosures" says "DON'TDISCUSSOPERATIONALACTI^ITESONTHEWEB" 7^ Tiainingslide73thattheaccused received at AITgoes on to say,"Ensure information posted has no significant value totl^eadversaiy";"Alw^ays assume the adversary is reading your material"; and "Remember it iscalled the World Wide Web foraieason." 7^. The accused also received training on thedifferent types ofrecruiting utilized by terrorist organizations, particularly by Al-(^aeda, and thatthe number ofteiroristwebsites have jumped fiom less thanlOO to as many as 4,000 in the lastten years and many insurgency gioups have many sites and message boards to help theirnetwork. Testimony ofMr.Moul; PE51 (Power Point slides on the enemy and their use of theInternet). The accused had to passatest on INFOSEC^OPSEC in orderto proceed inline course.Testimony ofMrMoul;PE5(35FProgramofInsfiuctionandLessonPlan);PE6(35F AITStudentEvaluationPlan).The training demonstrates that the accused knewwho the enemy was and that the enemyused the internet. Tl^e accused passingatest onfi^FOSEC^OPSECand his corrective trainingfiirther demonstrate that he was not only taught the information, but he learned it and had anappreciation for its importance. Aieasonable inference follows that since Wikileaks.oig isawebsite on the Internet, and the accused knewthat the enemywas looking for any and allinformation on the Internet, thatthe Accused knew that by putting infbi^ation on the Internet, hewas giving the information to the enemy. This is particulaily true in light ofthe information thatthe accused was giving toWikileaks.oig,which he was specificallytiainedw^asofinteiest to theenemy. The accused's know^ledgeofenemy receipt is an inevitable conclusion given theevidence the prosecution presented on the accused's knowledge ofthe type of website thatWikileaks.oig was at the time the accused unlawfiilly transmitted the mformation to them(discussed below). This is circumstantial evidence ofthe accused'sactual knowledge.b. Non-Disclosure AgreementsIn addition, the prosecution offered evidence that the accused had to sign non-disclosureagreements (SF312). ^^^Testimony ofMr. Moul; PE 35 (Stipulation ofExpectedTestimony,MsIvoiy);PE59(AccusedNDA,dtd7Apr08); Testimony ofCW2Balonek;PE60 (AccusedNDA,dtdl7Sep08). The nondisclosure agreements described the responsibilities and specialtrust and confidence associated with having access to classified infoiiuation. ^^^PE59(accusedNDA,dtd7Apr08);PE60(accusedNDA,dtdl7Sep08).Thenondisclosuieagieementsexplain the potential damage and consequences associated with the unauthorized disclosure ofthat information. 7^. Furthermore, the non-disclosure agreements highlights that the classifiedinformation was the property ofthe US government. 7^. The significance ofthe NDA was alsoexplained to the accused. Testimony ofMr. Moul; PE 35 (Stipulation ofExpectedTestimony,Ms. Ivory);Testimony of CW2 Balonek. The accused even raised his right hand and vowed touphold the responsibilities contained in the nondisclosure agreement. ^^^PE35 (Stipulation ofExpectedTestimony,Ms.Ivory). Understanding and signing the non-disclosure agreementsfiirther ensured that the accused understood the importance ofprotecting classified informationand the consequences ofits unauthorized release. This is circumstantial evidence oftheaccused's acttial knowledge.c. Additional Information on the Accused's External Hard DriveThe prosecufion admitted the accused's external hard drive. See PE 11. That externalhard drive contains a wealth of training informafion in addition to the accused's OPSECslideshow discussed above. Id. Specifically, it contained the following:- the accused had a Microsoft PowerPoint brief titled "Insurgent Propaganda TTPs" onhis personal HDD. PE 11 (\PFC MANNING External HDD\0055-28MaylO\MANNINGExternalM Manning\Manning\Documents\Analyst\RefeienceMaterial\Lessons Learned\LessonsLearned\Tlireat\UFOUO_Iraql_Pi-opagaiida_TTPs_Brief_26Jan05.ppt).' Slide 17 says"Insurgent Information operations (10) becoming increashigly sophisticated - videos on theinternet and favorable news coverage on Arab media Al Jezeera (see list of pro-insurgentwebsites)." Id.- the accused had a copy of FM 2-0 titled "Intelligence" on his personal HDD. PE 11(\PFC MANNfi^G External HDD\0055-28May10\MANNfi^G-Extemal\1Maiuiing\Mamiing\Documents\Analyst\Field Manuals\FM_2_0-intel.pdf). The document statesadversaries "weapomy may range from a computer connected to the Internet to WMD." Id.- the accused had a copy of AR 525-13 titled "Antiterrorism" on liis personal HDD. PE11 (\PFC MANNING Extemal HDD\0055-28May 10\MANNfNG-External\1Manning\Manning\Documents\AnaIyst\0&I\OIP\SOP's_AR's\AR525_13 Anti-TeiTorism.pdf).It states that terrorists use "instances of web site tampering to further their cause." Id.- the accused has a copy of FM 7-100.1 titled "Opposing Force Operations" on hispersonal HDD. PE 11 (\PFC MANNING External HDD\0055-28May10\MANNING-Extemal\lManning\Manning\Documents\Analyst\Reference Material\pdf\fm7_100xl.pdf)- This documentstates "Rapid advances in technology have produced an incredibly complex global informationenvironment. Information and communications technologies have grown exponentially in recentyears. Satellite and cellular communications, direct-broadcast television (expanding theawareness of events, issues, and military activities), personal computers, global positioningsystem (GPS) technologies, wireless communication capabilities, and the Internet aie a fewexamples of the capabilities widely available to nations, as well as independent organizations andindividuals. Given such advances, the capabilities of both the OPFOR and its potentialadversaries are increasing in both sophistication and lethality. Tlie OPFOR tries to exploit suchtechnologies to gain the operational advantage." Id.- the accused has a copy of FM 7-100.1 titled "Opposing Force Operations" on hispersonal HDD. PE 11 (\PFC MANNING External HDD\0055-28May10\MANN1NG-External\lMamiing\Maiming\Docuinents\Analyst\Reference Material\pdf\fm71 OOx 1 .pdf). This docmuent' PE 11 and PE 12 are compilation exhibits that were admitted and contain computer images ofthe accused'sexternal hard drive (PE 11) and ".22" SIPRNET computer (PE 12). The prosecution can provide the Court with theappropriate viewing equipment or caii print each item referenced within this motion for the Court,6states "In contrast to other forms ofwaifaie,IW^(InfoimationWarfare)^actions might occurwithout access to largefinancialresources or backing orwithout^tate sponsorship. Informationweapons could be sofiware logic bombs or computer womis and vimses. IW could be conductedwith such easily accessible means such as cellular telephones and the Inteinet."7^^.-the accused hasacopyofFM7100.1 titled "OpposingForce Operations" on hispeisonalIIDD.PE1I(^PFCMANNlNGExtemalHDD^0055 28MayI0^MANNlNGExtemal^lMaiming^Manning^ocuments^nalyst^eferenceMateiial^pdf^fiu7 lOOxI.pdf). Chapter5ofthis document provides an oveiaiching discussion oflnfbimationWarfare. 7^.- the accused hasacopyofFM7-100.4titled "Opposing Force Organization Guide" onliispersonalHDD.PE11(^FC MANNING ExternalHDD^0055 28May10^ANNINGExtemal^IManning^Manning^ocuments^nalyst^eferenceMateiial^pdf^M7-100 4.pdf).AppendixCofthis document, in providing an exampleofalocal insurgent organization, statesthat "Depending on the size, nature, and focus ofthe insurgent organization, the direct action cell(IW) may be capable of several functions. Some example fiinctions...^include assisting^...inthe cyber-mining for intelligence. All ofthesefiinctionsaieintegrated to further short-and longrange goals."- the accused hasacopyofFM7-100.4titled "OpposingForce Organization Guide" onhispeisonalHDD.PE1I(^FCMANNINGExterna1IIDD^0055 28May10^ANNINGExternal^lMaiming^Manning^ocuments^nalyst^eferenceMaterial^pdf^FM 7-100-4.pdf).AppendixCofthis document, in providing an exampleofalocal insurgent organization, states"Close coordination is maintained with the IW cell for Internet communications."7^.the accused hasacopyofFM7-I00.4titled "Opposing Force Organization Guide" onhispet^onalHDD.PEf1(^FC MANNING ExternalHDD^0055 28May10^ANNfNGExtemal^1Manning^Manning^ocuments^Analyst^eferenceMateiial^pdf^M7-100 4.pdf).AppendixCofthis document, in providing an exampleofalocal insurgent organization, states"The mteinetisapoweiful recruitment tool. The recruiting cell maintains close coordinationwitli the infomnation warfare cell."7^The accused's possession ofall the above information is additional circumstantialevidence that the accused knew and understood ah of the above information, leadingto thereasonable inference that the accused knewthat by disclosing information to WikiLeaks.org hewas giving the information to the enemy,and specifically Al-^aeda.d. Accused ^nowled^eofSIGACTsIn addition to oflering evidence on the type ofinfbi^nation the accused would be seekingon the Internet, the prosecution also offered evidence that the accused was aware that SlGACTsincluded the type ofinformation that the enemy would be seeking and that the accused knewthatthe SIGACTsw^eie valuable and useful intelligence as discussed below. Theaccusedackirowledged the value by stating in the text file that accompanied the disclosed CIDNEdatabases on the accused's SD Card stating,"Tlus is possibly one of the more significantdocuments of ourtime,ietuoving the fog of war, and revealing the true nature of21st centuryasymmetiicwarfare."PE42(Readme.txt);.^^^TestimonyofSAShaveiThe prosecution offered numerous witnesses to testifyregarding the accused's knowledgeofSIGACTs.^^^,^.^.,Testimony ofSFCAnica;TestimonyofCW2Hack;TestimonyofCPTFulton;Testimony of CW2 Balonek. Accordingto SFC Anica, it was paitof the accused'sjob,mgaiiison, to combine information fiom the SIGACTsand pick out the most relevant andhuportant data and then create Pow^eiPoint presentations to biiefthe S2; vehicle-bom lEDs wereparticulariysignificantatthetime TestimonyofSFCAiuca.AccoidingtoCW2Hack,theaccusedhadmanySIGACTsorganizedinliisfolderonhisumt'ssharedriveinanextiemelymeticulous maimer. Testimony of CW2 Hack. The SIGACTsand other mtelligence reportswere oigamzed by geographical locations thatweietiedto an enemy threat group that theleadership had prioritized. 7^. The accused knew ofthe value and usefulness ofSIGACT reportswhen conducting an analysis of umtactivity,as he used the SIGACTsto create work product.^^^^7^;PE58. Spccifically,theaccusedgaveCW2HackaSIGACT report of anIEDattackthathadaunit in the same area of operation that 2d Biigade,10th Mountain was in, two years beforethey airived to assist CW2 Hack with his targeting mission as the Accused thougl^t the SIGACTwould be assist in the capture ofahigli value taiget.7^. The attack described the type ofweapon system that was used, as wefi as damage and equipment that was used. 7^. It alsoincluded an S2 assessment ofthe event. 7^. Similai1y,the accused pulled SIGACTsfbr CPTFulton, which would typically focus on lEDs, small arms, and direct and indiiectfiie.Testimony ofCPT Fulton. The accused would mine the information, organize the information,sort the information, and then plot the SIGACT infoiiuation on the map, so it was representedvisually and so analysis could be conducted based on enemypatterns and engagement aieasrepresented. 7^. The accused also pulled SIGACTsfiom CIDNE, and organized them on anexcel spreadsheet to show enemy trends. 7^ CPTFulton also testified that, in gairison, theAccused helped her prepaic the intelligence portion of the OPORD for the deployment.7^.Specifically,the accused gave CPTFulton the basis ofknowledge on all of the enemy tl^eatgioups.7^. Finally,according to CW2 Balonek, the accused put together an intelligence productthat compared the past three years ofliaq SlGACTs, and specifically looked at locations ofdifierent types ofattacks, such as lED attacks and small arms fire against convoys. TestlmonyofCW2BalonekThe evidence offered by the prosecution isareasonable iirference to showthe accusedki^ew the value ofthe SIGACTS fiom an intelligence point of view. He knew that individualSIGACTS could be used to create actionable intelligence products for the Commander. He alsokirewthe value ofhaving numerous SIGACTsand the products that could be created fiom theSlGACTs. HeknewagioupofSIGACTScouldbeusedtodecipherpatternsofbehavioroffiiendly and enemy units. Just as the accused would use SIGACTS to decipher enemy tactics,techniques, and procedures (TTPs), the accused knewthat the enemy would find the same valuein the ability to decipher our TTPs, and would find similar value in the ability to createactionable intelligence products fiom the SIGACTS. All the above leads toareasonableinference thatthe accused knew of this value priorto disclosing the SIGACTstoWikileaks.oigto be posted on the internet, to be accessible to all people globally,including the enemy. Theabove also leads toareasonable inference that the accused knewthat this information wasexactlythetypeofinfoimationthattheenemywouldseekoutandaccessandthattheenemywould have access to all the information as leaked on Wikileaks.oig.2. Information Accused Accessed During the Course ofhis Misconducta.ACICRenortThe defense acknowledged that the prosecution introduced evidence to show that theaccused accessed the ACICrepoit titled "Wikileaks.org—An Online Reference to ForeignIntelligence Services, Insurgents, orTeiToiist Groups?)" charged inSpecification 15 of ChargeILDefense RCM917Motion at 2. The defense, however, argues that accessing this articledoes not show that the accused had actual knowledge that by giving infbimation to Wikileaks, hewas giving it to the enemy. 7^^. The defense argues howthe accused interpreted the report intheir motion; however, there is no evidence ofthat interpretation bythe accused. 7^ These arethe defense'sinteipretationsandreserved for argument, thus not appropriate fbraRCM917motion. RCM917(c)iequiies the Court to view the evidence "in the liglrt most favorable to theprosecution."RCM917(c).The puipose of theACIC report, which was published on18March 2008,was to "assessthe counterintelligence threat posed to the US AmrybytheWikileaks.org Web site." PE45(UnclassifiedACIC Report). TheACIC report describes in detail what the author's research ofWikileaks.org revealed about Wikileaks.oig, their actions, and how they operated in 2008.PE45(UnclassifiedAC1CReport).The first bulleted"I^ey Judgment" ofthe ACIC reportisthat"Wikileaks.oigrepiesentsapotential force protection, counteimtelligence, OPSEC, andINFOSEC thieatto the US Ai^ny."PE45^nclassifiedAClCReport).Thesecondbulletstates,"Recent unauthorized release ofDoD sensitive and classified documents provide FISS,foreignteiTorist groups, insurgents, and otherfbreign adversaries with potentially actionable informationfortargetingUSfbices."7^. The sixth bullet says that "Wikileaks.org most likely has otherDoD sensitive and classified information in its possession and wih continue to post theinformation to the Wikileaks.org Website." 7^^. The ACIC report goes on to discuss the DoDand classified infomnation that Wikileaks.org has released in the past and how Wikileaks.orgposts all information that they receive without editorial oversight. 7^. TheACIC reportconcludes that "it must also be presumed that foreign adversaries will review and assess anyDoD sensitive or classified information posted to the WL.oig web site" and warns of adversariesincreasedabilitytocompleteiapiddata compilation tomoieefficientlydevelopactionableinfomnation for their use for intelligence collection, planning, ortaigeting purposes.Tire prosecution also offered evidence that the accused searched for Wikileaks.org orvariations ofthattermoverlOO times betweenlDecember 2009 and 15Maich2010onSIPRNET.TestimonyofSAShaver;PE61 (Intelink logs).Thelogsfurtherprovethathefiirther supplemented his knowledge ofWikileaks.org through these searches. 7^^. Theprosecution also admitted the image ofthe accused's .22 comptiter. ^^^PE12. That imagecontains an email that the accused sent to members ofthe S2section(CPT Lim, CPT Martin,CW2El^esman,1LTGaab,CW2Balonek, SPC Madaras, SPC Cooley)on15March2010,classifiedFOUO.PE12(^FCMANNINGPiimaiySIPR^251 27May10^225127May10^C^DocumentsandSettings^bradley.manning^Loca1Settings^pplicationData^iciosoft^Outlook^archive.pst^ootfolder^TopofPersonalFolders^Deletedltems^SentItemsl^^UNCLASSIFlED^BFOR OFFICIAL USEONLY^ACICCyberCollabeiationPoital^UNCLASSIFIED^^OR OFFICIAL USEONLYj).Inthatemail,thcaccusedstates,"Occasionally has good hits fiom extremist websites in ourOEl Found it earlier this evening.http:^^acicpoital.noith-inscom.aimy.smil.mil^cybei7default.aspx". 7^. According to thcACIClogs, theACICreport(ProductID^RB08 0617)isavailableatthe URL "http:^^acicpoitalnorthinscom.aimy.smil.mil^cybei7default.aspx''and the accused liiiked to theACIC report tl^oughthat URL.^^^PE64(ACICWebserverlogs);PE 45 (UnclassifiedACIC Report).Tlie prosecution offered evidence that the accused accessed die website containing theACICreport on1December2009,29 December 2009,lMarch2010,and7Maich2010.PE 70(Stipulation ofExpectedTestimony,Mi. Artale); PE 63 (ACIC metrics for theACIC report).The prosecution also offered evidence that the accused viewed the ACIC document on14February 20I0andIMarch2010.TestimonyofSAShaver;PE61(Intelinklogs).Tire above evidence leads toareasonable inference tliat based on the accused's repeatedaccess to the report, he not only read the ACIC report charged in Specification15of Charge IIbut that he read it multiple times. This is circumstantial evidence that the accused was put onnotice that by giving information to Wikileaks.org, the enemy would have access to and use theinformation. The accused was also put on notice by the ACIC report that Wikileaks.oig was notalegitimate media organization, since, according to the report,Wikileaks.oigposts allinformation they receive with no editorial oversight. PE45(UnclassifiedACIC Report). It isareasonable inference that given the accused's specific training on AL^aeda, he knewthe enemywould be AL^aeda based on the time period ofthe misconduct and the accused's knowledge andtraining on who our enemy was and our enemy's use ofthe Internet.b l I R 5 391 001408SimilaiIy,tliepiosectition offered evidence ofthe accused's knowledge thiough1IR5391001408. The subject of this IIR was "IntemetWeb Postings of Classified and for Official UseOnly Documents."PE99(IIR5391 001408).TheIIR discussed Wiki1eaks.oig,andaccoidingto file report, in December 2006,"Wikileaks.oig was established to encourage the anonymotisposting ofsensitive government and corporate documents." PE99(IIR5391 001408);.^^^^^.^^Testimony ofSA Mark Mander. Accordingto the IIR,"Wikileaks.orgself^desciibesas(quote)an tincensorable Wikipedia for untraceable mass document leaking and analysis(unquote)." 7^.According to the 2008 report, numerous classified and FOUO documents have been posted andcontinue to be available onWikileaks.org and its mirror sites. 7^The prosecution offered evidence that the accused searched forthe IIRon14Februaiy2010. ^^^PE 85 (Intelink logs);Testimony ofMr.MarkJohnson. The prosecution also offeredevidence that the accused movedacopy ofthe IIR to his personal Macintosh computer onl5February 2010. ^^^PE 127 (VoIumes.txt which showed the IIR was on the accused's personalMacintosh computer).The above evidence leads toareasonable inference that the accused's accessing theindividual IIR and moving it to his personal computer demonsfiates that the accused read the10documetrt. Again, by reading the IIR, the accused was put on notice that by giving informationto Wikileaks.oig,asite that was quickly gainingareputation for encouraging leaks of classifiedgovernment iirfoimationandawebsite that seemingly posted everything it received,would beused by the enemy. This is circumstantial evidence that the accused ki^ewtheenemywould beAl-^aeda based on the priorities ofthe United States and the accused's knowledge and trainingon who our enemy was and our enemy's useofthe Internet. This inference is reasonableconsidering the type ofinformation the accused was disclosing to the website, and his trainingthat made him aware ofthe type ofinfbmiationat^d the enemy's use ofthe Internet.c. C3 DocumentThe prosecution also offered evidence ofthe accused's knowledge tluough the ChaosCommunication Congrcss(C3) report, which reported on the December 2009 C3 conference, anannual event that attracts hackers, security researchers, computer hobbyists and maliciouscomputer users. The C3 report states that "the Internet is an essential communication tool forteiTorists." PE 43 (C3 report). Inregard to Wikileaks.oig, the report explains that it is "apublicly accessible Internet Website where individuals can contact with leaked information andhave it published to the public anonymously without feaiofbcing held legally liable."7^^. Thereport further states,"^tjhe information that can be disclosed includes, but is not limited to,classified information, trade secrets, corporate information, personally identifiable infomnation,and even operational data." 7^. The report also discusses the threat fiom the insider leakinginformation to Wikileaks.org, as Mr. JulianAssange was encouraging the leaking ofclassifiedand proprietary information at the conference. Testimony ofMr. FIosbuigh;.^^^^^.^^^PE 43 (C3report).The prosecution offered evidence that the accused searched for the report on 14Febiuary2010,just one day afierietttining fiom R^Rleave. ^^^TestimonyofSA Shaver; PE 85(Intelh^logs). The prosecution also offered evidence that the accused movedacopy ofthe C3report to his personal Macintosh computer on 15Febiuaiy 2010. Testimony ofMi. MarkJohnson; PE 127 (VoIumes.txt which showed the C3 document was on the accused's personalMacmtosh computer).The above evidence leads toareasonable inference that the accused's accessingtheindividual report and moving it to his personal computer demonstrates that the accused read thedocument. Again, by reading the report, the accused was put on notice that by givinginfbi^nation to Wikileaks.org,asite that was quickly gainingareputation for encouraging leaksof classified govermnentinfom:iationandawebsitethatseeminglypostedeveiythingitreceived,would be used by the enemy. This is circumstantial evidence that the accused knewthe enemywould be Al-t^aeda based on the priorities ofthe United States and the accused's knowledge andtraiiring on who our enemy was and our enemy's use ofthe Internet.3. Statements hv accusedThe prosecution introduced evidence of the accused's own statements that documentedhis knowledge that by giving information to Wikileaks.org, he was giving it to the enemy.11a. Chats withMi.Adrian LamoThe prosecution offered evidence that in his chats with Adrian Lamo, the accused calledthe disclosed Department ofState cables "world-wide anaichyin CSV format." PE30(Wiied.com chat logs of the accused and Mr.Lamo). The accused also asserted that the DoScables will affect "everybody on earth." 7^. The accusedfiirthernoted that "Hilary Clinton, andseveral thousand diplomats around the world are going to haveaheart attack when they wake uponemoining,andfindsanentirerepositoryofclassifiedfoieignpolicyisavailable,insearchableformat to the public...^L". 7^. It isareasonable inference that if the accused knewthateveryone in the world would have access to the information onWikileaks.oig, thatthe enemy,namely Al-^aeda would have access. This inforniationfiirtherreveals that the accused knew thevalue of the US goveriu^ent information contained in the Department ofState cables,wluchfiirther requires the conclusion that by disclosing that information to Wikileaks, that the acctisedknew he was giving the information to the enemy,as he knew tlie infi:^mration would be valuableto the enemy.Additionally,as pointed out in the defense brief, the accused ackirowledged that he"could'vesold^theinfbrmation^torussia or china, and made bank" but he did not "because it'spublic data" and "because another state would just take advantage of the information...try toget some edge." 7^. The defense argues that this statement shows the accused's "focus was ongetting certain inforniation to the American public in order to hopeftilly spark change andreform." Defei^eRCM917MotionfbrArticlel04at3. However, there is no evidencesupports the defense inteipietation ofthe chat, and should be left for argument. Theaccusednever once mentions the American public or the United States being any sort of motivation forhis crimes in any ofhis chats or emails. The statement cited by the defense instead requires theopposite conclusion, as it shows thatthe accused did not want to limit access to the informationto one group, but wanted everyone to see the information.b. Chats with Mr. Julian AssangeThe prosecution also offered evidence that the accused(dawgnetwoik) was chatting withMr.Julian Assange (pressassociation). Testimony ofMr.Johnson;PE 120 (Buddy Listfiom theAccused's personal computer listing pressassociation's contact information); PE 123 (Chatsrecoveredfi:^rthe accused's personal computer between pressassociation and dawgnet^voik). Inthose chats, onlOMaich 2010, the accused called Wikileaks.org the first "Intelligence Agency"for the general public. ^^^PE123(Chats recoveredfi^rthe accused's personal Mac betweenpressassociation and dawgnet^^oik). Tlris demonstrates that the accused does not think ofWikilcaks.org asancws organization. The chats with Mr. Assange also showthat the accusedknewthe inforniation that he transmitted to Wikileaks.oig would bepublished on the Internet.^^^PE 123 (Chats recovered forthe accused's personal computer between pressassociation anddawgnet^^oik). On6March 2010,theaccused asked Mr.Assange ifhe was "gonna give releaseashot?" Mr. Assange responded,"yes." 7^. The accused also asks Mr. Assange,"is it like theentire world is uploading to you?" Mr. Assangeiesponds with examples ofinfbrmationreleasesfrom Hungiy,Haiti, and Gemiany,indicating the international interest in his website. ^^^PE123 (Chats recovered for the accused's personal Mac between pressassociation anddawgnetwork).12In summary,it isareasonable inference that based on the above evidence that theaccused knew the enemyused the Internet, the accused knewwho the enemy was, and theaccused knewthe Wikileaks.orgwebsite was on the Internet and commonly contained classifiedofficial US government infoi^nation and was about to containalot more classified governmentinfoi^nation that would be ofvalue to the enemy courtesy ofthe accused.Althoughnot appropriate fbraRCM917motion, the defense argues in their motion thatthe accused did not have actual knowledge that by givingthe classified US governmentinformation to the eiieniythat the accused was giving the inforniation toWikileaks.org, theevidence supports the opposite conclusion through circumstantial evidence. Based on theevidence presented by the prosecution, it isareasonable inference that the accused was tiainedby the military on the enemy (particularly Al-(^aeda and UsamaBinLaden)and its use oftheInternet, the accused was tiained by the military on the types ofinlbrmation the enemy w^ould beseeking on the Internet, the accused was informed ofhow Wikileaks.oig conducted business byhis own searches during the coimnission ofhis misconduct, and the accused acknowledged in hisdiscussions during the commission ofhis misconduct that he knew exactly what he was doing indisclosing the charged information. Ultimately,aieasonablemference can be drawn based onthe circumstantial evidence that the accused knew that by giving information toWikileaks.oig,he was giving inforniation to the enemy,specificallyAl-^aeda.CONCLUSIONSince the prosecution has presented evidence on every element ofthe Specification ofChargeI(AriicleI04), the defense request to enterafinding ofnot guilty as to the Specificationof Chargelshould be denied. This is particularlytrue given the lower burden on the prosecutionto withstand anRCM917motion and the requirement thatthe Court must viewthe evidence "inthe lightmost favorable to the prosecution." RCM9I7(c).ANGELM. OVERGAARDCPT,JAAssistant Trial CounselIcertifythatlserved or caused to be sei^edatiue copy ofthe above on the Defuse Counsel,via electronic mail, onllJuly 2013.ANGELM.^O^ERGAARDCPT,JAAssistant Trial Counsel13

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh