Witness | US v Pfc. Manning, Special Agent Mark Mander, CCIU

posted December 17, 2011

UPDATE POST COURT-MARTIAL

United States v. Pfc. Manning was conducted in de facto secrecy. The public was not granted contemporaneous access to court filings or rulings during her trial. In addition to reporting on her trial, I transcribed the proceedings, reconstructed the censored appellate list, and un-redacted any publicly available documentation, in order to foster public comprehension of her unprecedented trial.

As a result of a lawsuit against the military judge and the Military District of Washington brought by the Center for Constitutional Rights, as well as my own FOIA requests and research, an official court record for US v. Pfc. Manning was released seven months after her trial. That record is not complete.

The official trial docket is published HERE and the entire collection of documents is text searchable at usvmanning.org.

*During the pretrial proceedings, court-martial and sentencing of Pfc. Manning, Chelsea requested to be identified as Bradley and addressed using the male pronoun. In a letter embargoed for August 22, 2013 Chelsea proclaimed that she is female and wished to be addressed from that moment forward as Chelsea E. Manning.

Special Agent Mark Mander, Army Computer Crime Investigative Unit (CCIU) witness at Bradley Manning’s Article 32 Pretrial Hearing, 12/17/11.

General Description

Case Agent on investigation from June, 9 2010 to November 2011.

On case and responsible for evidence transfer from Army CID to CCIU, inventoried all items and carried them into the CCIU room. Initial investigation started by Camp Liberty, then CCIU became involved.

Witness No. 2 on the December 2, 2011 Defense Request for Article 32 Witnesses

2.)XXXXXXXXXX [Special Agent Mark Mander, CCIU] is one of the law enforcement agents that conducted work on this case for the CCIU. He is the drafter of most of the CID Reports of Investigation. He is part of a joint investigation by CID and the Department of State (DOS) Diplomatic Security Service (DSS). Under the cooperative investigation agreement, CID is the lead investigative agency with primary responsibility for coordinating all leads affecting the U.S. Army, and DSS has responsibility for leads involving the DOS. The Federal Bureau of Investigation (FBI) later joined as a joint partner in the investigation with responsibility for providing counterespionage expertise, investigative support, and as the lead agency for all civilian related leads.

Special Agent Mark Mander mentions the following individuals in his testimony:

Two unnamed Army Computer Crimes Investigation Unit (CCIU) agents sent to CENTCOM in Florida where they obtained log files related to investigation of the Garani airstrike video. One could be Agent Wilbur (sp.), Army Computer Crimes Investigation Unit (CCIU), who, according to Mander’s testimony later, analyzed the path to the Garani file.
Robert E. Schmidle, Deputy Commander, US Cyber Command, who provided background info on Garani air strike. (Rainey Reitman transcribed “Lt. Col. Schmidtl (sp) provided background information about this video and a password. The file name in question was BE22PAX.zip” I cross references that with the March 16, 2012 Article 39(a) session.)
Adrian Lamo
Jason Katz, former employee of Brookhaven National Labs between February 2009 to March 2010, implicated by Adrian Lamo. Investigation into Jason Katz is beng directed by the FBI. Mr. Lamo contacted CCIU about Mr. Katz boasting about helping to decrypt.
Unnamed personnel at the State Department concerning Intelink.
Unnamed personnel at the Intelink that gave Special Agent Mark Mander, Army Computer Crimes Investigation Unit (CCIU) a disk with logs.
Pfc. Manning’s aunt, Debra Van Alstyne.
Four unnamed agents that interviewed Bradley Manning’s aunt, Debra Van Alstyne (One of them was a Diplomatic Security Service (DSS) at the Department of State (State Department) (DoS) agent.
Diplomatic Security Service (DSS) at the Department of State (State Department) (DoS) agent that interviewed Bradley Manning’s aunt, Debra Van Alstyne.
Unnamed authorizing authority (a magistrate) for the warrant to search Bradley Manning’s personals after he was placed in confinement.
Agent Aims Army Computer Crimes Investigation Unit (CCIU) Acting Operations Officer did search authorization, interviews and administrative tasks. Special Agent Mark Mander’s supervisor.
Agent King, Army Computer Crimes Investigation Unit (CCIU) Acting Operations Officer did search authorization, interviews and administrative tasks.
Special Agent Schaller (sp.), Army Computer Crimes Investigation Unit (CCIU) Did analysis of media from Iraq.
Special Agent Johnson Army Computer Crimes Investigation Unit (CCIU) Did analysis of media from Iraq.
Another Special Agent Army Computer Crimes Investigation Unit (CCIU) [missed Name in Transcript] Did analysis of media from Iraq.
Agent Wilbur (sp.), Army Computer Crimes Investigation Unit (CCIU) Analyzed the path to the Garani file.
Special Agent Edward, Army Computer Crimes Investigation Unit (CCIU). Adrian Lamo contacted him at the end of May 2010.
Two unnamed agents from Army Computer Crimes Investigation Unit (CCIU) went to the US State Department to collect cables.
Unnamed individual who reported to David Coombs that he was interviewed five of six times.
Seven unnamed civilians, who, Special Agent Mander Army Computer Crimes Investigation Unit (CCIU) testified, were doing wrong doing, now being investigated by the Federal Bureau of Investigation (FBI), and which, according to Mander’s testimony, include “in certain aspects” the founders, owners, or managers of WikiLeaks.
Unnamed individual who Lamo contacted “us” about and said was chatting with someone else.
Unnamed individual Adrian Lamo talked to told two unnamed people. Someone on a project he had worked on, and a friend. Both of those people told law enforcement. One was in the Army. The other sent an email to “our” office account and left his name.
Unnamed Army Criminal Investigation Command (CID) Agent who collect Manning’s personals at the Kuwait facility where Manning was confined (Camp Arifjan).
Unnamed ex co-workers contacted by Army CCIU lead investigation as forensic analysis became available.

Article 32 Pretrial Transcript:

See Transcript of US v Pfc. Bradley Manning, Article 32 Pretrial Hearing, 12/17/11

[Special Agent Mark Mander was sworn in by Captain Angel Overgaard, prosecutor.]

IO: If at any time during your testimony you feel your answer is classified please inform the IO.

[Prosecution establishes Special Agent Mark Mander’s credentials.]

Mander: Became a CID in 1994 with a seven-year break, in total approx 10 years.

Prosecution:How many cases?

Mander: Me and others, where I advised, 200. Been with CCIU for 4 years.

Prosecution:What computer training have you completed?

Mander: Attended training at Defense Cyber Crimes Center, courses in collection of computer evidence. 300 hours of training.

Prosecution:How many cases at CCIU?

Mander: 20 cases.

Prosecution:When did you become involved?

Mander: Initial investigation started by Camp Liberty, then CCIU became involved.

Prosecution:Role?

Mander: Case Agent on investigation.

Prosecution:Why Iraq and not CCIU?

Mander: Initial allocation was Iraq because that is where the crimes were committed. That is the policy of one office, relating to another. Initially opened by the office in the vicinity of the crime.

Prosecution:Why was it transferred?

Mander: It was determined that for search warrants and special warrants needed from a Federal judge [He mentions Google and Twitter], CONUS leads, and the technical nature of the matter more suited to CCIU. Items were custodian’ed from Iraq to Dulles International Airport. I inventoried all items and carried them into the CCIU room. The majority of the investigation plan was based on Lamo of Manning and other documents obtained from PFC Manning’s personnel file. CCIU obtained chats from Mr. Lamo and collected computer belonging to Mr. Lamo…on those hard drives.

Prosecution:Found anywhere else?

Mander: I believe corresponding info found from PFC Manning…

Prosecutor:What did you find?

Mander: 2007 Apache air strike video, info about Afghan war logs, detainees of GTMO, mentions of state dept cables.

Prosecutor:What did CID do?

[So to clarify, he is saying that the information was from the chat logs. And the next part he was talking very fast was him saying how they investigated based on that ‘Intel’]

Mander: Garani video believed to have been on shared — by CENTCOM. Initially, CCIU attempted to connect and download those documents and that was collected as evidence. CCIU determined it was not sufficient. So CCIU sent two agents to CENTCOM in Florida where they obtained log files related to investigation. Several weeks later [Robert E.] Schmidle [Deputy Commander, US Cyber Command] provided background info on Garani air strike. The file was BE22PAX.zip. That file was believed to be Garani air strike video. Lamo contacted us and related that he became aware on the Internet of someone that he did not know, who was part of the original decryption effort, who worked for DOE [Department of Energy], which we believed was Manning.

Rainey Reitman transcribed “Lt. Col. Schmidtl (sp) provided background information about this video and a password. The file name in question was BE22PAX.zip” I cross references that with the March 16, 2012 Article 39(a) session.

Prosecution:How did you verify?

Mander: Lamo was able to…Mr. Jason Katz. Mr. Jason Katz had previously been identified as an employee of Brookhaven National Labs. He was employed February 2009 to March 2010. His reason for being fired was for engaging in inappropriate computer activity. We additionally obtained forensic imaging, which was authorization by a network connection agreement with his government assigned and personal computer.

Prosecution:Did CID get authorization to search?

Mander: CID and the FBI obtained a Federal warrant to search, and did that search on the government work station

Mander: The file was identical. The file was named ‘B.zip’ within that file was another file named BE22PAX.wmb (Mander wasn’t sure about .wmb) video file.

The file was encrypted and password protected. The file appeared to be same video.

The second week of June, two CCIU agents obtained circle log files…obtained IP locations of where the State Department stored… obtained firewall logs.

During an initial attempt to get log files one person at State Dept said Intelink. Intelink allows people to find classified docs.

Prosecution:Did CID collect logs from Intelink?

Mander: Collected disk from personnel there, from IP address of the government workstation…Office of Director of National Intelligence (ODNI).

Prosecution: Did you collect logs from CIA?

Mander: Yes.

Prosecution:Did you try to collect more from ODNI?

Mander: Keywords people searched. Also CENTAUR logs based on IP address.

Mander: CENTAUR is a government name for NetFlow logs. Connection logs to and from, time and date, length…

Prosecution: What sorts of leads did you pursue?

Mander: About June 18, 2010 I was involved in contacting and interviewing Manning’s aunt. She was identified through his personnel file. Myself and four other agents, as well as Dept of State interviewed her about what she may know. We discussed a wide range of topics: family, where his mother was from, how he was brought up, and the circumstances of enlistment prior to apprehension. Manning had contacted his aunt two times while in Iraq: to ask her about the 2007 Apache video, and secondly to ask her to make a posting referencing the 2007 Apache video.

Prosecution:Did you search that residence, since it was the place of residence in his personnel file?

Mander: Yes. His belongings were obtained in a basement room. We looked through that room, and specifically for digital media, as well as anything he sent her while in Iraq. Upstairs in her room was a computer powered on while he was in Iraq. She could not use that computer.

Prosecution:Did you collect that?

Mander: Yes.

Prosecution:Visit again?

Mander: Yes.

Mander: In October a package came from the confinement center in Kuwait. After Manning’s apprehension and confinement they collect his personals. The facility said that we needed a warrant to search those belongings. There was a hold up with the administration. The authorizing authority for the warrant said we shouldn’t need one. By that time we got that figured out, Manning was transferred, and his effects were sent to his aunt’s home, and signed by his dad.

Prosecution:What did the aunt tell you?

Mander: She had the unopened box. She saved the box and allowed us to go into basement to find other items.

Prosecution:Find anything else?

Mander: Yes. In June when we searched the room, it had no organization. She had organized his items into plastic containers. We identified numerous items that were digital media. All those items were selected. Most important, on an SD card we found various classified data. We split the room into two parts, photographed were item were found, and placed those items on the bed. When we were done we asked his aunt if she could look at items, and verify that they were his.

Mander: She verified them.

[Defense cross-examines Special Agent Mark Mander.]

Defense:You are a case agent?

Mander: Yes.

Defense:Lead case agent?

Mander: Normally in CID there is typically one agent. A case agent manages leads in case. Because of the numerous locations of investigation activity, in this instance I was the case agent on paper…supervisors took more active role.

Mander: Agent Aims and Agent King were acting operations officers.

Defense:Primary roles?

Mander: Search authorization, interviews and administrative tasks.

Defense:Not just search authorizations but federal magistrates?

Mander: In some cases at his aunt’s house, we collected the items with her consent and then searched for authorization later.

Defense:So when talking about analysis on media in Iraq?

Mander: No. Special Agent Schaller (sp.), Johnson, and {another) Special Agent (I did not get his/her name).

Defense:Regarding Lamo, the detainees at GTMO, the Garani air strike, the 2007 Apache video, all that you did not see?

Mander: I did not conduct analysis.

Defense:So which agent did analyze the path to Garani?

Mander: Agent Wilbur (sp.) CCIU. At this time, I do not remember the report.

Mander: Special Agent Aims was my supervisor. The others were peers.

Defense:You were not directing them?

Mander: No

Defense:Did you have any interaction with Mr. Katz or Mr. Lamo?

Mander: Mr. Lamo contacted Special Agent Edward at CCIU. Mr. Katz…I don’t believe CCIU directed Mr. Katz. That was FBI. I do not know if Mr. Katz contacted Mr. Lamo. I do not know if they had direct contact.

Defense:When did Lamo start to cooperate with CID?

Mander: Probably at end of May 2010…

Defense: Regarding the cables: Two agents went to the Department of State, did you accompany them?

Mander: No. The first group went to collect; the second was provided by the State Department.

Defense:So this is just from reports?

Mander: No.

Defense:Why would his childhood be relevant to the investigation?

Mander: It turned out not to be. Friendships he may have had…there was a great deal of concern about a foreign intelligence service. We were looking for information to prosecute. Were others involved? Military records showed Manning had lived overseas prior joining Army.

Defense:Were other people contacted or interviewed by CID?

Mander: A fair number.

Defense:Anyone followed up? Some people told me you interviewed them five or six times, and they were irritated. Is that typical?

Mander: No. It is not typical. This was not a typical investigation. One issue there was no forensics, or they were ongoing. Agents were collecting information thought to be relevant, and then we would go back with new information. That was the reason for the numerous visits.

Defense:And is it true that this was the only case you were working on? How long?

Mander: Yes. June 9 – Nov 2011 I had at times other cases, and would try to keep up, while on this case.

Defense:Whom else did you uncover doing wrongdoing?

Mander: Seven other civilians. The FBI is potentially involved. I do not know what the FBI has determined.

Defense:Do they include the founders, owners, or managers of WikiLeaks? Was WikiLeaks in this case?

Mander: Yes they are involved in certain aspects.

Defense:Is it your determination, would you agree that my client would have been unable to do this by himself?

Mander: Depends on charge. “Something by himself”…other charges require interaction with others.

Defense:Did my client possess the ability to upload from his cubical in Iraq?

Mander: Yes. He could have upload to multiple sites.

Defense:Would he not also require the cooperation of others to post to (indecipherable)?

Mander: Not if he owned site. Mr. Lamo contacted CCIU about Mr. Katz boasting about helping to decrypt. Lamo contacted CCIU about an unknown individual who was chatting with someone else. Don’t know if he ever met that person.

Defense:How was he aware?

Mander: I am not aware.

Defense:Was he working with CID at the time? Before or after?

Mander: His initial information started the investigation. A person Lamo talked to told two people: Someone on a project he had worked on, and a friend. Both of those people told law enforcement. One was in the Army. The other sent an email to our office account, and left his name.

Defense:Did Lamo receive benefit?

Mander: Not that I am aware.

Defense:Who is the primary lead CCIU for WikiLeaks?

Mander: Camp Liberty, Army CID and the Department of State. Then the FBI became involved and joined the investigation. The State Department became involved immediately because of nature of information obtained in chats. A month into the investigation the FBI became involved.

Defense:What about the Department of Justice started to investigate WikiLeaks?

Mander: They spoke with advisers early in our investigation…one US attorney from the Eastern District of Virginia.

Defense:What did they say?

Mander: Ongoing discussions, best practices for investigating classified info…they advised CID.

Defense:Were they experts in this kind of investigation?

Mander: Yes.

Defense:You mentioned that when PFC Manning was confined in Kuwait, can you provide details of the search authorization?

Mander: We identified the container. We contacted the Kuwait facility to search, had and agent from CID in Kuwait to collect. The facility said we needed to have a search warrant. We contacted a magistrate. There was a legal disagreement. The magistrate felt we did not need authorization due to his status as confinee. We went back to facility, but only in regard to “safety and security”…violations of his confinement strategy, but by the time we figured that out, he had been transferred.

[Prosecution then re-examines Special Agent Mark Mander.]

Prosecution (Overgaard):Defense brought up numerous individuals being interviewed multiple times. Why did that happen?

Mander: Again, forensic examination is a slow process, as items of investigation were reported, we would contact ex co-workers and ask if they knew about the information. That was how did the process worked.

Prosecution:Why?

Mander: We were trying to identify all the evidence related to this investigation.

[Special Agent Mark Mander is excused.]

Other Resources:

Transcript of Article 32 Pretrial Hearing, Day Two, 12/17/11. (Source: Alexa O’Brien)
In Depth Notes (Source: Rainey Reitman, Chelsea Manning Support Network)
Live Blog (Source: Kevin Gosztola, Fire Dog Lake)