Prosecution witnesses also testified that a file allegedly deleted from one of Manning’s work computers contained more than 100,000 State Department cables. And a May 2010 e-mail that was sent to an acquaintance — and that Manning apparently thought he had encrypted — said, “I was the source of the 12 July 07 video from the Apache weapons team which killed two journalists and injured two kids.”
The steady disclosure of evidence was highly damaging, experts said, as prosecutors attempted to paint a picture of a leaker who knew he was breaking military rules.
“You add it up, add it up, and eventually it gives people something approaching a moral certainty” that Manning committed the crimes, said Eugene Fidell, a visiting lecturer in military justice at Yale Law School. “I would be surprised if the defense was sipping champagne this evening. Private Manning is in serious trouble.”
Manning, 24, wearing fatigues and Army-issue dark-framed glasses, sat at a table with his defense team, taking notes or speaking to his attorney, mostly without expression. Also monitoring proceedings have been attorneys for the London-based Assange, who are concerned that he could face criminal conspiracy charges in the United States.
The hearing will determine whether Manning’s case proceeds to a court-martial. If it does, he could face as many as 22 charges, including aiding the enemy — a crime whose punishment could be the death penalty or life in prison — and violating the Espionage Act.
On this fourth day of the hearing, investigators said they recovered from one of Manning’s work computers a deleted file containing four assessments of detainees at Guantanamo Bay, Cuba; a corrupted, deleted file containing 10,000 State Department cables that apparently was never sent to WikiLeaks; and a deleted file with more than 100,000 diplomatic cables that had been compressed for apparent ease of transfer.
The chats between Manning and Assange, whose user name was “email@example.com,” were recovered from Manning’s laptop, prosecutors said.
“The substance of the chat was predominantly discussion of government information and specifically sending or receiving that information,” said Mark Johnson, a contract forensic examiner with the Army Computer Crimes Investigative Unit. He said Assange and Manning discussed WikiLeaks and assessments of detainees at Guantanamo Bay.
He also said that Manning’s laptop contained evidence that a secure file transfer connection had been set up between a Verizon Internet address registered to his aunt’s home and a secure server associated with a Swedish Internet service provider known as PRQ, which has been affiliated with WikiLeaks.
Johnson said Manning’s laptop password was the same as the one he used to log on to his secure work station in Baghdad: TWink1492!!
Investigators also recovered from Manning’s laptop an instruction to “Acquire and Exfiltrate the Global Address List of United States Forces Iraq” and “thousands” of e-mail addresses for soldiers in Iraq, Johnson said.
He said Manning erased data from his laptop twice in January 2010, making it impossible for investigators to retrieve any information before that month.
Johnson examined an external hard drive belonging to Manning that had been in his quarters in Baghdad. It included a document titled “wl-press.txt” created on Nov. 30, 2009, around the time Manning is said to have initiated contact with WikiLeaks. That document included the message, which was projected on a courtroom screen:
“You can currently contact our investigations editor directly in Iceland at 354 862 3481, 24 hour service, ask for Julian Assange.”
The memory card investigators found was among Manning’s belongings at his aunt’s home, in the Maryland suburb of Potomac, where Manning lived before joining the Army in 2009 and while on home leave in January 2010. On that card were four files, one containing 91,000 reports from a database of Afghanistan field reports, and a second containing 400,000 Iraq field reports, said Special Agent David Shaver, also with the Army’s Computer Crimes Investigative Unit.
A third file on that card contained a document titled: README.txt.
It appeared to be a note to accompany the Afghanistan and Iraq “significant activity” reports, saying they were drawn from the Defense and State departments and covered the period from Jan. 1, 2004, to Dec. 31, 2009, which corresponds with the time frame of the war reports WikiLeaks published.
“These items have already been sanitized of any source identity information,” it said, as Shaver read it and a copy was projected on a courtroom screen. “You might need to sit on this information for 90 to 100 days to figure out how best to send and distribute such a large amount of data to a large audience” and to protect the source of the data.
It continued: “This is perhaps one of the most significant documents of our time, removing the fog of war and revealing the true nature of 21st century asymmetric warfare. Have a good day.”