Manning Hearings: Files on His Computer Don't Match WikiLeaks Releases

Interesting account from Wired on forensic expert testimony in accused Wikileaker Bradley Manning's pre-trial Article 32 hearing:

A day after a government forensic expert testified that he'd found thousands of diplomatic cables on the Army computer of suspected WikiLeaks source Bradley Manning, he was forced to admit under cross-examination that none of the cables he compared to the ones WikiLeaks released matched.

Special Agent David Shaver, a forensic investigator with the Army's Computer Crimes Investigations Unit, testified Sunday that he'd found 10,000 U.S. diplomatic cables in HTML format on the soldier's classified work computer, as well as a corrupted text file containing more than 100,000 complete cables that had been converted to base-64 encoding.

Six months after Manning was arrested for allegedly leaking documents to WikiLeaks, the site began publishing 250,000 U.S. diplomatic cables that ranged in date from December 1966 to the end of February 2010. But Shaver said none of the documents that he found on Manning's computer, and that he then compared to those that WikiLeaks published, matched the WikiLeaks documents.

Shaver wasn't asked how many cables he compared to the WikiLeaks cables, or which dates those cables had, he just said he matched "some of them." In re-direct examination, however, he noted that the CSV file in which the cables were contained was corrupted and suggested this might indicate that it had not been possible to pass those cables to WikiLeaks for this reason. The defense objected to this assumption, however, noting that Shaver could not speculate on why the cables were not among those released by WikiLeaks.

As always, it gets complicated:

In addition to the State Department cables found on Manning's computer, Shaver also testified Sunday that he'd found links between evidence on Manning's laptop and two other WikiLeaks releases: the so-called "Collateral Murder" Apache helicopter video and Gitmo prisoner assessments….

Shaver discovered scripts for Wget — a web-scraping tool — on Manning's computer that pointed to a Microsoft SharePoint server holding copies of the Gitmo documents. He ran the scripts to download the documents, then downloaded the ones that WikiLeaks had published, compared them and found they were the same, Shaver testified.

He also said he found two copies of the Apache video on Manning's work computer in unallocated space.

But Shaver was forced to admit on Monday that he was not aware that soldiers in the secure facility Manning worked in had been viewing that controversial video and talking about in December 2009, months before WikiLeaks published it. That, the defense seemed to suggest, would explain why a copy might be on Manning's computer.

Reason on Bradley Manning.

Comments

[Episiarch]

He also said he found two copies of the Apache video on Manning’s work computer in unallocated space.

If this reporter is using the correct words, this isn’t possible. So I guess I should just assume the reporter is an idiot, which is usually the safe assumption.

[waffles]

Can you explain to me the error in that statement?

I took the statement to mean that the videos were deleted but still exist on the disk and were found/restored. Is that wrong or silly to believe?

[Warty]

What the reporter wrote means that the files were in space that doesn’t belong to a filesystem. Not possible.

[Warty]

Oh, fuck you, squirrels.

[Warty]

What the reporter wrote means that the files were in space that doesn’t belong to any filesystem. Not possible and a contradiction on its face.

[Episiarch]

Unallocated space is, by definition, unallocated. There can be no files there. It is theoretically possible for there to be the remnant of files there if the space was recently unallocated and not formatted, but the likelihood of them being intact is low and the drive would have had to have been actively modified and space de-allocated purposefully.

[sarcasmic]

When a file is deleted, all that means is the space that it occupies is now available. If nothing is written to that space then the file is still there. Deleting does not format the space.

[Episiarch]

Delete and de-allocate are completely different things. He used the words “unallocated space”. Meaning it is not referenced as part of the file system. You can’t delete a file from a part of the disk that isn’t referenced by the file system; the file system literally has no visibility into that area of the drive. That is why it is unallocated.

[sarcasmic]

Perhaps the admin that set up his work computer didn’t do a good job clearing the previous user’s garbage.

Wouldn’t surprise me. I’ve met more than one government admin and they were complete idiots.

[Episiarch]

Or perhaps, as I said originally, the reporter has no fucking clue what they’re talking about.

[Zeb]

I’d say it’s probably a bit of both.

[Brian E]

Ok Epi, what does the “A” in FAT stand for? Space which is not marked as “A” would be referred to as what?

[Warty]

Epi is completely right here, despite the fact that he smells like bearshit. I imagine the reporter decided to use the word “unallocated” to mean that the file had been deleted and then recovered.

[SugarFree]

“Epi is completely right here”

I know all those words, but strung together like that it’s just nonsense.

[The Host of Baba Ram Dass]

“Epi is completely right here”

Ah, but is he completely right here NOW?

[The Ghost of Richard Albert]

That’s Ghost, dammit!

[Warty]

“Epi is completely right here, and also covered in his own excrement and pus.”

Happy?

[Warty]

All you need to do is revogalize the drive’s kyrnical turnbulators, you idiot. Don’t you know anything about computinators?

[Episiarch]

If you don’t recombobulate the KROG and then delobter the DREF, you will end up with a frillstered TREW. You fucking moron.

[Warty]

THE POX KILLSES THE KITTIES FIRST

[tarran]

I bet they’re using Allocate from its meaning in the days of FAT.

It might mean that he had two copies on his hard drive which then got deleted -> leaving the data on the disk without pointers from the file system pointing to it.

For example, he downloads the file to his downloads directory. He copies it to his ‘Files to Leak’ directory. He then deletes the file from his downloads directory.

Voilla, a copy in unallocated space!

[waffles]

this seems probable. It may just be an unintentional blurring of terms.

[Warty]

It looks to me like the reporter was trying to look knowledgeable by throwing around some tech jargon. Nails on a chalkboard.

[Proprietist]

YOU’RE dog vomit.

[Proprietist]

Wow, don’t know how that got up here. Was directed at “Mr. Mark.”

[Warty]

Epi is dog vomit, so you’re forgiven. The truth is the truth.

[Episiarch]

You’re a towel!

[Res Publica Americana]

Oh, not now for songs of a nation’s wrongs,
not the groans of starving labor;
Let the rifle ring and the bullet sing
to the clash of the flashing sabre!
There are Irish ranks on the tented banks
of Columbia’s guarded ocean;
And an iron clank from flank to flank
tells of armed men in motion.

With pale affright and panic flight
Shall dastard Yankees base and hollow,
Hear a Celtic race, from their battle place,
Charge to the shout of “Faugh-a-ballaugh!”
By the sould above, by the land we love
Her tears bleeding patience
The sledge is wrought that shall smash to naught
The brazen liar of nations.

Whoe’er shall march by triumphal arch
Whoe’er may swell the slaughter,
Our drums shall roll from the Capitol
O’er Potomac’s fateful water!
Rise, bleeding ghosts, to the Lord of Hosts
For judgement final and solemn;
Your fanatic horde to the edge of the sword
Is doomed line, square, and column!

[Ugh, song lyrics]

D-

[Mr. Mark]

If he didn’t do it, then by all means, he should be set free. Unfortunately, I don’t think that’s the case. I think he did it, and I think they’ll prove it. And if they prove it, his punishment should be harsh.

With regard to Reason/Wired’s fascination with poor misunderstood Manning, the Military Channel’s been running some interesting documentaries on collaborators recently…all about folks who rationalized helping out really bad folks.

It’s kind of like when somebody leaks classified videos of an engagement from a helicopter, edits the footage to make it look like something it isn’t, and thereby slanders American servicemembers and provides propaganda to terrorist and insurgent groups that like to do things such as run power tools through fellow Iraqi civilians’ kneecaps.

The person who did what Manning is accused of is dog vomit. They should be disposed of as such.

[Appalachian Australian]

The Military Channel, an excellent source of unbiased journalism. Much more reliable than those hacks over at Reason Foundation or Huffington Post.

We need to keep all documentation about the Iraq war secret in perpetuity because it might be used to promote terrorism! Especially any documentation of actual abuses commited by the U.S. Those would definitely be fodder for terrorists. Nothing is to be released except photos of soldiers giving flowers to Iraqi children.

The truer the accusation, the more guilty the libeler.

[John]

Bullshit. Manning took and oath. He knew what he was doing was wrong. He deserves to go down. I wouldn’t send him away for life. But I sure as hell wouldn’t let him walk.

[Appalachian Australian]

Took an oath to defend the Constitution.

Not an oath to defend the state.

[sarcasmic]

In other news, Kate Moss is still hot!

http://www.dailymail.co.uk/fem…..llers.html

[califronian]

The problem with these Bradly Manning updates is that all the fascist boot-lickers who can’t get enough ‘Murrican Imperialism come out in droves.

[Episiarch]

They seem to be out in droves without the Manning impetus.

[Res Publica Americana]

I’m the very opposite of an imperialist. My foreign policy could be justifiably described as isolationist, if that term were to encompass solely foreign policy. But I think Manning (assuming he’s guilty) and the rest of the leak-men are assholes. What the fuck did he hope to accomplish?

[califronian]

To let the people be informed about what their government is up to?

[John]

By getting people killed?

[califronian]

right on cue.

[mad libertarian guy]

Bullshit, John. How many people died as a direct result of Manning’s releases? How could you possibly hope to prove that?

And do you really think that leaking the cables puts people in more danger than, say, CONTINUOUSLY BOMBING/ATTACKING MIDDLE EASTERN COUNTRIES?

[rather]

“that none of the cables he compared to the ones WikiLeaks released matched”

Is the defense asking for a dismissal? How does is work with JAG?

[CalebT]

The fourth Manning brother?

[Fist of Etiquette]

We format our diplomatic cables in HTML? No wonder the rest of the world hates us.

[Warty]

Any self-respecting diplomatic corps would hand-code its cables in TeX, obviously.

[Episiarch]

Hey, at least it isn’t in PDF form.

FUCK YOU ADOBE

[John]

the better question is how did some cross dressing frustrated private in Baghdad have access to all of them? Whatever happened to “need to know”?

[Warty]

Top. Men.

[Fist of Etiquette]

He was a cross-dresser? I hadn’t read that.

Normally, closeted homosexuals have been treated as potential extortion risks when it comes to state secrets, but that didn’t seem to be the case with Manning. If he did what he’s accused of doing, it seems it was ideological, no?

[Warty]

I doubt he was. That sounds suspiciously like a smear campaign.

[Appalachian Australian]

The military is short-staffed, so they hand out security clearances like candy.

It’s unfortunate.

From what I’ve read on less-than-reliable sources (namely HuffPo), Manning’s orientation was not much of a secret. And obviously any homosexual in the military until a few months ago was in the closet, courtesty of DADT.

[John]

I am not sure he was a cross dresser. I was being facetious. But he was an is most definitely a practicing homosexual.

And even though he had a security clearance, he still had no need to see those cables. He was an intelligence analyst in Baghdad. The fact that he had that access shows total negligence on the Amry’s part.

[First of Etiquette]

Klinger never stole Col. Potter’s files.

[Ska]

But don’t ask what happened to that picture of Sherman T. with the prize winning race horse.

[protefeed]

It sounds like the defense attorney is doing his or her job well, trying to confuse those judging this case by using complex technical arguments that makes it seem like maybe someone else put all those files on a computer he controlled.

I don’t it’ll work, but you gotta give props to the defense attorney for trying this angle.

[Appalachian Australian]

If someone else did leak the files, a smart move would be to frame Manning for it by planting evidence on his computer.

[Zeb]

Yes, he did wrong. If it turns out he did what he is accused of, it is appropriate that he be punished. He knew he was breaking the rules.

But I honestly don’t think he did anything all that terrible. I have yet to be convinced that anything was released has caused any real harm to any person.
I am far more concerned about the over use of classification. It seems like very little of what was released should have ever been secret in the first place.

[Paul]

What is this story saying, that Manning is innocent because he didn’t do anything wrong, or that manning is innocent because he didn’t do anything. It’s a subtle difference, but an important one. I’ve not followed the wikileaks thing super closely (and julian assange seems to have lost some of his cachet), but I was under the impression that Manning’s defenders were asserting that Manning had dumped the “cables” to wikileaks, but that act was a forgivable sin…or something. This wired piece makes it sound like they’ve arrested the wrong guy.