Manning Hearings: Files on His Computer Don't Match WikiLeaks Releases
Interesting account from Wired on forensic expert testimony in accused Wikileaker Bradley Manning's pre-trial Article 32 hearing:
A day after a government forensic expert testified that he'd found thousands of diplomatic cables on the Army computer of suspected WikiLeaks source Bradley Manning, he was forced to admit under cross-examination that none of the cables he compared to the ones WikiLeaks released matched.
Special Agent David Shaver, a forensic investigator with the Army's Computer Crimes Investigations Unit, testified Sunday that he'd found 10,000 U.S. diplomatic cables in HTML format on the soldier's classified work computer, as well as a corrupted text file containing more than 100,000 complete cables that had been converted to base-64 encoding.
Six months after Manning was arrested for allegedly leaking documents to WikiLeaks, the site began publishing 250,000 U.S. diplomatic cables that ranged in date from December 1966 to the end of February 2010. But Shaver said none of the documents that he found on Manning's computer, and that he then compared to those that WikiLeaks published, matched the WikiLeaks documents.
Shaver wasn't asked how many cables he compared to the WikiLeaks cables, or which dates those cables had, he just said he matched "some of them." In re-direct examination, however, he noted that the CSV file in which the cables were contained was corrupted and suggested this might indicate that it had not been possible to pass those cables to WikiLeaks for this reason. The defense objected to this assumption, however, noting that Shaver could not speculate on why the cables were not among those released by WikiLeaks.
As always, it gets complicated:
In addition to the State Department cables found on Manning's computer, Shaver also testified Sunday that he'd found links between evidence on Manning's laptop and two other WikiLeaks releases: the so-called "Collateral Murder" Apache helicopter video and Gitmo prisoner assessments….
Shaver discovered scripts for Wget — a web-scraping tool — on Manning's computer that pointed to a Microsoft SharePoint server holding copies of the Gitmo documents. He ran the scripts to download the documents, then downloaded the ones that WikiLeaks had published, compared them and found they were the same, Shaver testified.
He also said he found two copies of the Apache video on Manning's work computer in unallocated space.
But Shaver was forced to admit on Monday that he was not aware that soldiers in the secure facility Manning worked in had been viewing that controversial video and talking about in December 2009, months before WikiLeaks published it. That, the defense seemed to suggest, would explain why a copy might be on Manning's computer.
