Witness | US v Pfc. Manning, Mark Johnson, ManTech International Contractor, reports to Special Agent David Shaver, CCIU

posted December 19, 2011

UPDATE POST COURT-MARTIAL

United States v. Pfc. Manning was conducted in de facto secrecy. The public was not granted contemporaneous access to court filings or rulings during her trial. In addition to reporting on her trial, I transcribed the proceedings, reconstructed the censored appellate list, and un-redacted any publicly available documentation, in order to foster public comprehension of her unprecedented trial.

As a result of a lawsuit against the military judge and the Military District of Washington brought by the Center for Constitutional Rights, as well as my own FOIA requests and research, an official court record for US v. Pfc. Manning was released seven months after her trial. That record is not complete.

The official trial docket is published HERE and the entire collection of documents is text searchable at usvmanning.org.

*During the pretrial proceedings, court-martial and sentencing of Pfc. Manning, Chelsea requested to be identified as Bradley and addressed using the male pronoun. In a letter embargoed for August 22, 2013 Chelsea proclaimed that she is female and wished to be addressed from that moment forward as Chelsea E. Manning.

General Description

Mark Johnson is a computer forensic examiner employed as a civilian contractor with ManTech International at Fort Belleville, West Virginia. Johnson reports to Special Agent David Shaver Computer Crimes Investigation Unit (CCIU). Johnson testified that he worked previously as a defense contractor.

Johnson testified that he examined Manning’s personal computer, an Apple MacBook Pro. After Johnson verified the MD5 hash for the forensic image of the MacBook Pro, Johnson said he looked for two things: the alleged Adrian Lamo chat logs and for classified Government information.

Johnson testified that he found Adium, a multi-protocol chat application that works with different instant messenger applications, on Manning’s MacBook Pro.

Johnson testified that he found chat logs between a user profile “bradass87” and Adrian Lamo. Johnson said [the transcriber did not specify which account on Adium] had the following contacts: “dawgnetwork@jabber.ccc.de”, “pressassociation@jabber.ccc.de”, and “Adrian”. Johnson said that “pressassociation@jabber.ccc.de” was associated with the name “Julian Assange”, and in the unallocated space of Manning’s MacBook Pro pressassociation@jabber.ccc.de was associated with the alias Nathanial Frank.

Johnson testified that he found a chat between “dawgnetwork@jabber.ccc.de” and “pressassociation@jabber.ccc.de” in the unallocated space of Manning’s MacBook Pro, which Johnson said consisted of discussions of “Government information and receding or rescinding of that information.” Johnson could not recall the time frame of those chats. The alleged Adium chat logs, Johnson said, were found in XML format.

Johnson testified that the chat log between “dawgnetwork@jabber.ccc.de” and “pressassociation@jabber.ccc.de” totalled 14 to 16 pages. Johnson testified that he believed that “dawgnetwork@jabber.ccc.de” and “pressassociation@jabber.ccc.de” discussed Iceland. Johnson testified that “dawgnetwork@jabber.ccc.de” and “pressassociation@jabber.ccc.de” discussed WikiLeaks and JTF GTMO [Joint Task Force Guantanamo], but Johnson is not sure if they discussed the Department of State (State Department) (DoS) Reitman notes that during cross-examination Johnson admitted that there was no evidence found of a connection to a particular known WikiLeaks associate. The transcriber noted that defense had asked “In one report you wrote Red Buicks?” Johnson answered, “Yes.” Defense then asked, “Isn’t it true that you wrote that Red Buicks had no connection to Manning?” According to Reitman these questions related to this line of questions concerning Julian Assange and a known WikiLeaks associate. The transcriber notes that Johnson’s answer to the latter question was that he could not recall.

Johnson testified that both chats between “dawgnetwork@jabber.ccc.de” and “pressassociation@jabber.ccc.de” showed evidence of SFTP – Secure File Transfer Protocol, which is part of SSH, or Secure Shell protocol. In Manning’s MacBook Pro home folder was an SSH file. Johnson specifically mentions the IP address 88.80.17.76, which Johnson associated with PRQ ISP based in Sweden; Johnson states that the logs also noted IP address 72.66.112.117, that he associated with Manning’s aunt’s computer; and the URL lain.knack.net. Johnson testified that 72.66.112.117 resolved to Verizon Communications, and was connected to the account of Manning’s aunt, Debra Van Alstyne.

Johnson testified that he looked for references to those IP addresses in the unallocated space of Manning’s MacBook Pro. Johnson said one IP address connected to Collateral Murder: “It was a URL.” Johnson testified that he found 72 addresses that reference to a Thunderbird email cache.

Johnson testified that he found an email between Manning and Eric Schmiedl. Johnson says the alleged email chain was found through carrots. The alleged email was encrypted. Johnson says the private key for Manning’s PGP key was on Manning’s MacBook Pro, and Manning’s PGP password was the same as his OS X login. In the alleged email chain that occured between 11 May 2010 and 19 May 2011, Manning allegedly writes,”I was the source of the 12 Jul 07 video of the Apache Weapons team which killed the two journalists and injured two kids.”

Johnson testified that Manning’s MacBook Pro had the capacity to insert and burn CD’s, and that a number of CD’s had been burned and erased. Johnson testified that he found the disc utility log for Manning’s MacBook Pro that had entries between February 27, 2010 and March 9, 2010, but Johnson was unable to find what kinds of files were on the CD’s.

Johnson testified that during the investigation a CD was found in Manning’s Containerized Housing Unit (CHU) that had been marked SECRET. Reitman notes that Johnson took “the file name from this CD and found a similarly-named one in the unallocated space on the Mac.” Reitman also notes that Johnson “described /volumes as being a ‘mounting point'” or the starting point for a directory. Reitman says, Johnson testified that he “searched the /volumes path to see what he could find. Among the things he discovered was a file named “Jul 07 C2 ENGAGEMENT ZONE 30 FC Anyone.wmv”

Johnson testified that he found “that file name” [I assume Johnson is referring to “TWINK zone” or “Jul 07 C2 ENGAGEMENT ZONE 30 FC Anyone.wmv” but am unsure] nearby the string “/volumes”. Johnson clarified that means he found a file name associated with “/volumes” that asserted a CD had been found. Johnson testified he wanted to find out if a CD had been attached to Manning’s MacBook Pro. Johnson testified that in the unallocated space of Manning’s MacBook Pro was an excerpt of the /volume disc utility log that showed date and file name of /volumes and included a list of discs and a list of files attached. The last disc burned and visible in the disc utility log was 4 May 2010 “files.zip”. A disk was burned on 15 February 2010 [transcriber only noted naming convention].

In the unallocated space on Manning’s MacBook Pro, Johnson testified that he found 16,000 HTML Web pages of Department of State (State Department) (DoS) cables. Reitman notes that Johnson and the Government prosecutor presented an unclassified cable entitled, “Cambodia Remains Non Committal on Kosovo, pulled from Net Centric Diplomacy” version August 2, 2010.

Johnson testified that in the unallocated space of Manning’s MacBook Pro he found .csv files. Johnson testified that he did not find .C4 files in the unallocated space of Manning’s MacBook Pro. Johnson testified that he found a script used to take an input HTML file output to .csv files in the allocated space on Manning’s MacBook Pro. According to Johnson, that script appeared to be PHP. Johnson testified that he booted Manning’s MacBook Pro hard drive hard disk image using an investigative Mac, imported the script, and exported .csv files with Department of State (State Department) (DoS) cables.

Johnson testified that he found HTML pages that references the WikiLeaks upload page in the unallocated spaces of Manning’s MacBook Pro. Johnson and the Government prosecutor presented an archived copy of one such alleged page. Johnson testified that in the unallocated space on Manning’s MacBook Pro he found status or progress script updates with an upload identifier and historical status or progress reports.

Johnson testified that he found files encrypted with Mcrypt related to Farah Province, Afghanistan that were associated with parts one to four [Reitman notes seven (7) parts, not four (4) parts]: “no-openpgp -d -farah.key -a rijnduel-256 farah.part*.rar.nc” and evidence of Mcrypt. The transcriber did not specify if Johnson identified where he found those files/evidence on Manning’s MacBook Pro.

Johnson testified that he found references in a path on the unallocated space of Manning’s MacBook Pro pointing to Manning’s desktop that referenced Farah archive folder.

Using a tool designed to find remnants, or files within files, Johnson testified, he found evidence of a Farah archive. [The transcriber did not specify where Johnson found those files/evidence on Manning’s Apple MacBook Pro.] Johnson stated he was able to recover enough to open the content, which consisted of a classified operation information PowerPoint presentation and some photos,but Johnson could not say what the file consisted of beyond that.

Johnson testified that he found in the unallocated space of Manning’s MacBook Pro text-based files that appeared to be a tasker.

Johnson testified that he found thousands of exchange formatted email addresses that the Government prosecutor associated with evidence of the United States Forces – Iraq Microsoft Outlook Share Point Exchange Server global address list (GAL) [unallocated spaces of the MacBook Pro. Reitman notes, that on cross examination, Johnson admitted, the United States Forces – Iraq Microsoft Outlook Share Point Exchange Server global address list (GAL) was not found on Manning’s MacBook Pro.

Johnson testified that he found a .rtf text file that contained discussion of Guantanamo Bay (GTMO) that listed detainee names in the unallocated space on Manning’s MacBook Pro.

Johnson testified that there were two specific instances of evidence of the MacBook Pro being wiped: An erasure of the hard drive on 25 January 2010 and erase of free space on 31 January 2010. Johnson testified that the erasure of the unallocated space in 31 January 2010 was cancelled according to the disk utility log.

Johnson testified that prior to this case he had never done forensics on an Apple.

Reitman notes that on cross-examination Johnson admitted that the MacBook Pro was set to automatically login.

Johnson testified that he may have come across references to Web pages related to gender identity disorder or identity problems but he wasn’t looking for that. Johnson testified on cross-examination that he understood Breanna Manning to be the alter ego of Private Manning.

Johnson testified that he examined a forensic image of the external drive taken from Manning’s Containerize Housing Unit (CHU) at FOB Hammer, Iraq. Johnson testified that he found a 13 June 2008 PowerPoint presentation “Operation Security (OPSEC) PV2 Manning, Bradley, D Company, 305th Military Intelligence Battalion” and a wl-press.txt file created on November 30, 2009 at 20:23:29 that had the contact information for Julian Assange: “You can currently contact our investigations editor directly in Iceland. 354 862 3481 24 hour service; ask for Julian Assange.”

Individuals mentioned in the testimony of Mark Johnson, ManTech International Contractor, who reports to Special Agent David Shaver, Army Computer Crimes Investigative Unit (CCIU).

Adrian Lamo
Julian Assange
Debra Van Alstyne, Manning’s aunt
Eric Schmiedl

Evidence presented in the testimony of Mark Johnson, ManTech International Contractor, who reports to Special Agent David Shaver, CCIU

This is a running list of evidence presented by the Government in open Court. The items should not be taken as statements of fact, since this list does not contain the Government’s methods or modes for conducting the analysis, and in some cases the evidence is inconclusive, circumstantial, or disputed as not criminal as per elements or items as charged. I have compiled this list to investigate the Government’s case. The public is also not privy to the classified portions of this contractor’s testimony, so one cannot say with certainty if any of the Government’s methods or assertions have come under countering scrutiny by the defense during those sessions.

Pfc. Manning’s Apple MacBook Pro.

Alleged Adium contact list in the allocated space of the MacBook Pro.
Screenshot of alleged Adium chat logs found in XML format [not clear if Johnson found in the allocated or unallocated on Manning’s MacBook Pro] between “bradass87” and Adrian Lamo.
Alleged Adium chat logs in XML format between “dawgnetwork@jabber.ccc.de” and “pressassociation@jabber.ccc.de”, who Johnson says is associated with the name Julian Assange. Johnson says that the chats were 14 to 16 pages and found in the unallocated space on Manning’s MacBook Pro.
SSH file log in the home folder of Manning’s MacBook Pro.
Alleged PGP messages from Manning’s Thunderbird email account from Manning to Eric Schmiedl. Message is found by Johnson was encrypted. The email chain allegedly occurs between 11 May 2010 and ends on 19 May 2011 when Manning allegedly writes,”I was the source of the 12 Jul 07 video of the Apache Weapons team which killed the two journalists and injured two kids.”

Manning’s PGP private key.
Manning’s PGP password.

Disc utility log for Manning’s MacBook Pro with entries that began on February 27, 2010 and ended March 9, 2010.
A file name associated with the CD marked SECRET collected from Manning’s Containerized Housing Unit (CHU) with “/volumes” that asserted the CD had been found in the unallocated space of the MacBook Pro.
In the unallocated space an excerpt of the /volumes disc utility log that showed a list of volumes and files attached.

Jul 07 C2 ENGAGEMENT ZONE 30 FC Anyone.wmv
Last disc burned and visible in the disc utility log was 4 May 2010 “files.zip”
Disk burned on 15 February 2010 [transcriber only noted naming convention].

16,000 HTML Web pages of Department of State (State Department) (DoS) cables in the unallocated space of Manning’s Apple MacBook Pro.

“Cambodia Remains Non Committal on Kosovo” pulled from Net Centric Diplomacy version August 2, 2010 unclassified HTML Department of State (State Department) (DoS) cable in the unallocated space of the MacBook Pro.

.csv files in the unallocated space of Manning’s MacBook Pro.
A script used to take an HTML input file and output .csv files in the allocated space on Manning’s MacBook Pro. According to Johnson, the script appeared to be PHP. When the script was imported to an investigative Mac it exported Department of State (State Department) (DoS) cables.

The final output of .csv file via this exported script run on the Government’s investigative Mac.

HTML pages that references the WikiLeaks upload page in the unallocated spaces of Manning’s MacBook Pro, namely an archived copy of one such page.
Status or progress script updates with an upload identifier and historical status or progress reports in the unallocated space on Manning’s MacBook Pro.
Files encrypted with Mcrypt related to Farah Province, Afghanistan associated with parts one to four [Reitman notes seven (7) parts, not four (4) parts]: “no-openpgp -d -farah.key -a rijnduel-256 farah.part*.rar.nc” and evidence of Mcrypt. [The transcriber did not specify where Johnson found those files/evidence on Manning’s Apple MacBook Pro.]
References in a path on unallocated space of Manning’s MacBook Pro pointing to Manning’s desktop that referenced Farah archive folder. The transcriber did not specify where Johnson found those files/evidence on Manning’s MacBook Pro.
Partial screen shot of Manning’s desktop. Manningb_00409680.
Encrypted mail message. Manningb_[Missed]. Manningb_00409682. Transcriber did not notate if Johnson explained the contents of this email.
Keychain use on Manning’s laptop: Manningb_00409683.
Classified operation information in a PowerPoint presentation and some photos related to Farah Province, Afghanistan. [The transcriber did not specify where Johnson found those files/evidence on Manning’s MacBook Pro.]
MacBook Pro text-based files that appeared to be a tasker in the unallocated space of Manning’s MacBook Pro. [The transcriber did not specify where Johnson found those files/evidence on Manning’s MacBook Pro.]
“Thousands” of Exchange formatted email addresses that the prosecution associated with the evidence of United States Forces – Iraq Microsoft Outlook Share Point Exchange Server global address list (GAL) in the unallocated spaces of the MacBook Pro.
Disk utility log. [Not sure if this is different then the disk utility log listed above.]
.rtf text file that contained discussion of Guantanamo Bay (GTMO) and a listed detainee names in the unallocated space on Manning’s MacBook Pro.
Install log found in the Install Officer.

CD found in Mannings’ Containerized Housing Unit (CHU) marked SECRET
External drive taken from Manning’s Containerize Housing Unit (CHU) at FOB Hammer, Iraq

13 June 2008 PowerPoint presentation “Operation Security (OPSEC) PV2 Manning, Bradley, D Company, 305th Military Intelligence Battalion” found on an external drive taken from Manning’s Containerize Housing Unit (CHU) at FOB Hammer, Iraq.
wl-press.txt file created on November 30, 2009 at 20:23:29 that had the contact information for Julian Assange: “You can currently contact our investigations editor directly in Iceland. 354 862 3481 24 hour service; ask for Julian Assange” found on an external drive taken from Manning’s Containerize Housing Unit (CHU) at FOB Hammer, Iraq.

First appearance of Mr. Mark Johnson, Contractor for ManTech International who reports to Special Agent David Shaver, Army Computer Crimes Investigative Unit (CCIU), Article 32 Pretrial, 12/19/11 (by an anonymous journalist, ed. by Alexa O’Brien)

See Transcript | US v Pfc. Manning, Article 32 Pretrial, 12/19/11 (by an anonymous journalist, ed. by Alexa O’Brien)

MR. MARK JOHNSON, MANTECH INTERNATIONAL CONTRACTOR WORKING FOR US ARMY CCIU.

[Mr. Mark Johnson, ManTech International Contractor, reports to reports to Special Agent David Shaver, CCIU]

Johnson: I am not a Special Agent. I am a contractor for ManTech International. Worked for ManTech for the whole time. I am a computer forensic examiner. Special Agent David Shaver is my supervisor. Previously I worked for a different defense contractor.

Prosecution: Training?

Johnson: Been through Defense [Missed. Probably Department of Defense Cyber Crime (DC3)] Center’s courses for computer crime investigator and computer examiner.

Prosecution: Other certifications?

Johnson: Certified Information Systems Security Professional – C.I.S.S.P.

Prosecution: At any time were you assigned to examine digital media?

Johnson: I examined [Missed] from Manning’s private computer, Apple MacBook Pro.

Prosecution: What did you do when you received?

Johnson: MD5 hash…verified it was not changed, that it was a correct image.

Prosecution: Verified?

Johnson: Yes.

Prosecution: And…?

Johnson: Ran antivirus scan. We were looking for two things: Adrian Lamo chats and for classified Government information.

Prosecution: What did you do?

Johnson: I looked for presence of chat programs. Found Adium. It is multi-protocol – works with different instant messenger applications.

Prosecution: So you found Adium. What did you find?

Johnson: Looked in his [Manning] profile.

Prosecution: Did you find chats?

Johnson: Yes.

Prosecution: Who were the chats between?

Johnson: Between Mr. Adrian Lamo…

PRESENTATION

[The person who transcribed this did not record what the presentation was. Rainey Reitman notes, “The prosecution then showed an image of the chat lots on the screen. The chat logs on the screen displayed the named “Manning” and “Adrian Lamo” and the timeframe was indicated as 12:49:17 a.m. to 12:56:07 a.m. One of the first lines said something about an ‘Apache Weapons Team’.” Reitman says the presentation was removed before she could note anything more.]

Prosecution: What is this?

Johnson: This is an excerpt of chats.

Prosecution: Who are they between?

Johnson: Between Adrian Lamo…

Prosecution: What are they talking about?

Johnson: In this, they are discussing…

DEFENSE INTERJECTS

[The transcriber writes that they could not understand what Coombs was saying. There was confusion in the Courtroom. Recess was called.]

COURT IN RECESS

1:38 p.m. COURT IN SESSION

PROSECUTION CONTINUES TO EXAMINE MR. MARK JOHNSON, MANTECH INTERNATIONAL CONTRACTOR WORKING FOR US ARMY CCIU.

Prosecution: Mr. Johnson, you are still under oath. We were discussing chat logs found in Adium. What were the usernames?

Johnson: My recollection is “bradass87” and “Adrian”. Content was various topics including Government information.

Prosecution: Did you find a buddy list?

Johnson: Yes. Adrian was a buddy. Also there was “pressassociation@jabber.ccc.de”

[Rainey Reitman notes, “Here Johnson found contacts that included Adrian, dawgnetwork@jabber.ccc.de, and pressassociation@jabber.ccc.de” ]

[Missed. Prosecution clarifies.]

Prosecution: Whose alias was associated with that?

Johnson: At that time it was Julian Assange.

PRESENTATION

[Rainey Reitman describes the presentation as:

The prosecution again showed how this alias was displayed on the screens like this:

pressassociation@jabber.ccc.de Julian Assange

Johnson also found a former entry for this buddy in the unallocated space. It was displayed on the screen as:

pressassociation@jabber.ccc.de Nathanial Frank ]

Johnson: We also found something in the unallocated space. Same user account but a different alias – Nathaniel Frank.

Prosecution: So you found two different aliases. Do you find it odd?

Johnson: Unusual.

Prosecution: What did you do?

Johnson: Looked for other connections to Nathaniel Frank.

Prosecution: What stood out in the chats?

Johnson: Discussions of Government information and receding or rescinding of that information.

Prosecution: What was the time frame?

Johnson: Don’t recall.

PRESENTATION

[Rainey Reitman describes the presentation thus:

The prosecution then showed a portion of the chat log with pressassociation dated 2010-03-05. I copied down what I could before they removed the slide:

pressassociation: 5-6 hours for total upload?
dawgnetwork: uploaded
dawgnetwork: no, it was like 5 minutes
dawgnetwork: ping
dawgnetwork: ping
dawgnetwork: anyway, should be good to go with that
dawgnetwork: news?
dawgnetwork: …
dawgnetwork: hi
dawgnetwork: hiya
pressassociation: i like debates.
pressassociation: just finished one on the IMMI, and crushed some wretch from the journalists union
dawgnetwork: vid?
pressassociation: of this?

Reitman says there were a couple lines at the bottom she didn’t have time to transcribe before the slide was taken down, but she got most of it.]

Johnson: This information is a cleaned up version of the logs that were in unallocated space.

Prosecution: So you found the chats in XML format? Were they readable?

Johnson: Yes. But difficult to read. You can export them out. What you see here is the spreadsheet version of chat logs. Headings bolded by me for readability.

Prosecution: This all of it?

Johnson: Only a small snippet. 14 to 16 pages total.

Prosecution: Did you read the chats? Were the people familiar?

Johnson: Yes, I did. Yes, it was clear they had known each other in the past.

Prosecution: Did they discuss Iceland?

Johnson: Don’t recall. Believe so.

Prosecution: WikiLeaks?

Johnson: Yes, Sir.

Prosecution: Did they discuss Department of State?

Johnson: Don’t recall.

Prosecution: J.T.F. G.T.M.O. [Joint Task Force Guantanamo]?

Johnson: Yes, Sir, they did.

Prosecution: Let’s talk about other findings. Evidence of connection between computers?

Johnson: Yes. In both chats with Nathanial Frank and the previous one, we noticed SFTP – Secure File Transfer Protocol, which is part of SSH, or Secure Shell protocol.

Prosecution: You noticed SSH file?

Johnson: We found in Manning’s home folder the known host file.

PRESENTATION

[No specific information about what this presentation was from the transcriber. Reitman says, Johnson specifically mentions the I.P. address 88.80.17.76, which Johnson associated with PRQ I.S.P. based in Sweden; Johnson states that the logs also noted I.P. address 72.66.112.117, that he associated with Manning’s aunt’s computer. Reitman also says there was mention of the U.R.L. lain.knack.net]

Prosecution: That looks like an I.P. address. Where does it resolve to?

Johnson: Goes back to PRQ, an I.S.P. based in Sweden known to be affiliated with WikiLeaks.

Prosecution: Second?

Johnson: Verizon Communications. Connected to the account of Manning’s aunt.

Prosecution: Third?

Johnson: Both resolve to the same PRQ noted earlier.

Prosecution: So you found this. What did you do next?

Johnson: Looked for other references to those addresses. In unallocated space found an address connected to Collateral Murder. It was a URL.

Prosecution: What about the other I.P.?

Johnson: 72 addresses we found reference to the Thunderbird email cache – keeps a copy of your email on online accounts.

Prosecution: What did you do to the email?

Johnson: We knew he was using Thunderbird. Found PGP [Pretty Good Privacy] emails.

PRESENTATION

[Rainey Reitman describes the presentation as:

In the effort to transcribe as quickly as possible, I didn’t include the full email addresses and other address information down:

5/19/10

I was the source of the 12 Jul 07 video of the Apache Weapons team which killed the two journalists and injured two kids.

>> 5/[1]2/10
>>12:46 AM
>>From: Eric Schmiedl
>>Yes I am

>>>>5/11/10
>>>>5:46 PM
>>>>From: Manning
>>>>Are you familiar with the WikiLeaks?

v/r

Manning, Bradley E.

Reitman says she would like the verify the dates, because she was writing very quickly.]

Johnson: PGP message from his Thunderbird email account. Email from Manning to Eric Schmiedl. Message is encrypted.

Prosecution: Find any unencrypted?

Johnson: Did find one between Manning and Eric Schmiedl.

Prosecution: So there were emails back and forth?

Johnson: Yes. There were emails back and forth, which we found through carrots.

Prosecution: How does one decrypt email as an examiner?

Johnson: Need access to private key associated with the sender. I need Manning’s private key and the password to unlock.

Prosecution: Did you get it?

Johnson: Yes. It is on his computer.

Prosecution: How did you get password?

Johnson: Turned out he used same PGP password as his OS X login.

Prosecution: So you got in?

Johnson: Yes. Private Manning automatically logged himself on.

Prosecution: What was his password?

Johnson: TWINK1492!! I could take encrypted messages, run through PGP, and export out in clear text.

Prosecution: You said it was a MacBook Pro? Did it have a way to insert C.D.’s?

Johnson: Yes.

Prosecution: What did you find?

Johnson: A number of C.D.’s had been burned and erased over time.

Prosecution: What is this?

PRESENTATION

[Reitman describes this presentation slide as the disc utility log. The entries in the log began on February 27, 2010 and ended March 9, 2010.]

Johnson: This shows C.D. Re-writable media being erased. This one is from February 27, 2010.

Prosecution: Can you tell what kind of files were on the C.D.’s?

Johnson: No.

Prosecution: Find anything else?

Johnson: During investigation, C.D. was found in Manning’s unit that had TWINK zone on it. [Reitman notes this as Jul 07 C2 ENGAGEMENT ZONE 30 FC Anyone.wmv]

Prosecution: C.D. found in C.H.U. C.D. marked SECRET?

Johnson: Yes.

Prosecution: So you took that file name and looked for it on his computer?

Johnson: We found it nearby the string “volumes”.

Prosecution: What does that mean for a Mac?

Johnson: In order to attach a disk to a volume, it uses a mounting point.

Prosecution: So you found a file name associated with “volumes” that asserted a CD had been found?

Johnson: Yes.

Prosecution: What next?

Johnson: Wanted to find out if a C.D. had been attached to his computer.

Prosecution: Find anything?

Johnson: Yes, Sir.

PRESENTATION

[Reitman describes this presentation as:

The prosecution put up a slide showing what was found, but it was unfortunately difficult to read. In general, it appeared that files discovered in /volumes followed the format of:

/volumes/CD or disc name/date and time/file name.

Johnson said that this was similar to how Roxio saved file names. The last disc burned and visible in the disc utility log was May 4, 2010 – it was files.zip.]

Prosecution: What is this?

Johnson: An excerpt found in the unallocated space mentioning “volumes”.

Prosecution: I see “volumes” and a date. Can you explain?

Johnson: The last part there is the file name.

Prosecution: Ok, I’m sorry. Any other evidence?

Johnson: Yes, Sir. When we found the list of discs, we found a list of files attached.

PRESENTATION

[The transcriber did not note any specific information about presentation.]

Prosecution: What is this?

Johnson: Output of some of the volumes. I will do one. [Transcriber notes that Johnson makes an example.] [In the first column], we have the name. Then [in the second column] the volume.

Prosecution: You familiar with Roxio?

Johnson: Yes.

Prosecution: That the way Roxio burns a disc?

Johnson: I believe it would be.

Prosecution: What is the date of first disc on the bottom?

Johnson: February 15, 2010. It’s the date-time. Following disc name, you have path or whatever is on that optical media.

Prosecution: Find these file names anywhere else?

Johnson: Disc names found to be a match to the discs burned on the SIPRnet computers.

Prosecution: What is the last volume record?

Johnson: “files.zip” burned May 4, 2010.

Prosecution: So this was found in the unallocated space?

Johnson: Yes.

Prosecution: So it was deleted?

Johnson: Yes.

Prosecution: So we talked about this before – you can still search an unallocated space?

Johnson: Yes.

Prosecution: What else did you find?

Johnson: We found a number of HTML formatted files.

Prosecution: What were these HTML files?

Johnson: They were of Web pages of Department of State cables.

Prosecution: Recognize this?

PRESENTATION

[Reitman describes this as an unclassified cable entitled, “Cambodia Remains Non Committal on Kosovo, pulled from Net Centric Diplomacy” version August 2, 2010.]

Johnson: This is an unclassified file. Embassy name. Part of the MRN [Message Record Number] number [used by Department of State to correctly identify cables].

Prosecution: Did you search?

Johnson: Yes. We identified approximately 16,000 cables in the unallocated space.

Prosecution: Find .csv files?

Johnson: We found.csv files too.

Prosecution: Find basic .C4 files?

Johnson: No.

Prosecution: Find a script?

Johnson: Yes. Miniature program to process input files to output files. Appeared to be PHP.

Prosecution: Recognize this?

PRESENTATION

[The transcriber did not provide information about presentation.]

Johnson: This is a script used to take an input file and output .csv .

Prosecution: Found in allocated?

Johnson: Yes.

Prosecution: Takes an input and converts to output?

Johnson: Yes. .html to .csv file. We then booted his hard drive using our investigative Mac – an alternate boot if you will. We imported the script and exported .csv files with the embassy cables.

PRESENTATION

[The transcriber did not provide information about presentation.]

Prosecution: Recognize?

Johnson: Yes. Screenshot. Every time it processes a cable, you get another line of data.

Prosecution: What about this?

Johnson: Final output of .csv file. It has been imported into a spreadsheet for easier reading.

Prosecution: Did you find any other Web pages?

Johnson: Yes. References to the WikiLeaks upload page.

Prosecution: What is this?

PRESENTATION

[Reitman describes this presentation as:

Johnson also found references to the WikiLeaks upload page in the unallocated spaces, and pulled up an archived copy for audience viewing.]

Johnson: This references the WikiLeaks page. This has a link that goes to the WikiLeaks upload page.

Prosecution: Find any other evidence of uploads to WikiLeaks?

Johnson: Yes. Status or progress script updates with an “upload identifier”.

Prosecution: What is this?

PRESENTATION

[Reitman describes this presentation as:

Johnson also found a number of historical status or progress reports.]

Johnson: Progress screen I was making reference to. Found on unallocated space. Down here [bottom] you can see dates and times. More importantly, we have “Upload Complete” indicating that file upload had probably been completed.

PRESENTATION

[Reitman describes this presentation as:

Johnson then described “.rar” as being an archive file format not unlike .zip. He said that files ending in .nc were associated with the encryption program Mcrypt. He found references to Mcrypt in a file format:

no-openpgp -d -farah.key -a rijnduel-256 farah.part*.rar.nc]

Prosecution: Recognize?

Johnson: Yes. Files we were able to find, parts one to four. Cleaned up copy.

Prosecution: Describe the information on left?

Johnson: Yes. Information; year and dates; and upload U.R.L.

Prosecution: So there are four parts. What is a .rar file?

Johnson: It is very similar to .zip files.

Prosecution: What is [Missed]?

Johnson: That is Mcrypt.

Prosecution: Find evidence of Mcrypt?

Johnson: Yes.

PRESENTATION

[The transcriber did not provide information about presentation.]

Prosecution: What is this?

Johnson: This is used to start up the Mcrypt program. Farah file.

Prosecution: What is [Missed]?

Johnson: Encryption program.

Prosecution: Did you find any other references to Farah archive on the computer?

Johnson: Yes. Found references in a path on unallocated space pointing to Manning’s desktop.

PRESENTATION

[The transcriber did not provide information about presentation.]

Prosecution: What are these?

Johnson: Pathways indicating Manning’s desktop, letting us know the files were in a folder named “Farah”.

Prosecution: You said you used tool to extract? What was tool?

Johnson: We extracted [Missed].

Prosecution: So the [Missed] tool does what?

Johnson: It is designed to find remnants. Files within files.

Prosecution: What did you find?

Johnson: We found evidence of a Farah archive. We were able to recover enough to open the content. We found a PowerPoint presentation and some photos.

Prosecution: What was it?

Johnson: Classified operation information?

Prosecution: Any details? What was it?

Johnson: Couldn’t say.

Prosecution: One of the charges relates to the theft of a local address. What did you find?

Johnson: Text-based files in the unallocated space that appeared to be a tasker.

PRESENTATION

[The transcriber did not provide information about presentation.]

Prosecution: What is this?

Johnson: This is the tasker found in the unallocated space.

Prosecution: Find any other evidence of global addresses?

Johnson: Yes. Number of exchange formatted email addresses.

Prosecution: How many?

Johnson: Thousands.

Prosecution: Another charge relates to J.T.F. reports from G.T.M.O. What did you find?

Johnson: One reformatted file. A text file that contained discussion of Guantanamo Bay and a listed detainee names.

Prosecution: Where was it found?

Johnson: Unallocated space.

Prosecution: Seems lots were found in the unallocated space. Evidence of computer being wiped or erased?

Johnson: Two specific references. Was first reinstalled in early January 2010.

Prosecution: What do you mean reinstalled? OS was reinstalled?

Johnson: Yes.

PRESENTATION

[The transcriber did not provide information about presentation.]

Prosecution: What is this?

Johnson: This is an install log. Found in the Install Officer.

Prosecution: So they [the plural word “they” instead of “he” was written by the transcriber] reinstalled the operating system and did a secure erase of what?

Johnson: The Operating System.

Prosecution: What else?

Johnson: Unallocated space had been erased in January [2010].

PRESENTATION

[The transcriber did not provide information about presentation.]

Prosecution: What is this?

Johnson: Disk utility log. It indicates that the option to erase free space had been executed.

Prosecution: Was it completed?

Johnson: Was not. It takes some time. It was probably cancelled.

Prosecution: So we have got the erase of the hard drive on 25 January [2010] and erase of free space on 31 January [2010].

Johnson: Means everything on computer was erased.

Prosecution: Mr. Johnson, I just want to show a few documents to the Investigating Officer while you are up here.

[Prosecution passes documents around the room.]

Prosecution: Mr. Johnson, recognize?

Johnson: First document, I do. Partial screen shot of Manning’s desktop. Manningb_00409680. Second document: Encrypted mail message. Manningb_[Missed]. Manningb_00409682. Keychain use on Manning’s laptop: Manningb_00409683.

Prosecution: What is a keychain?

Johnson: Mac OS keeps passwords encrypted in a keychain.

DEFENSE EXAMINES MR. MARK JOHNSON, MANTECH INTERNATIONAL CONTRACTOR WORKING FOR US ARMY CCIU.

Defense (Blouchard): Mr. Johnson, you are certified in computer forensics?

Johnson: Right.

Defense (Blouchard): Prior to this case, you had never done forensics on an Apple?

Johnson: No.

Defense (Blouchard): In one report you wrote Red Buicks?

Johnson: Yes.

Defense (Blouchard): Isn’t it true that you wrote that Red Buicks had no connection to Manning?

Johnson: Don’t recall.

Defense (Blouchard): Where do you do the work?

Johnson: Fort Belleville, West Virginia.

Defense (Blouchard): Who assigned?

Johnson: Don’t recall.

Defense (Blouchard): Do you have an opinion on S.C.I.F. security measures based on the work you did on this case?

QUESTION IS OVERRULED [Not clear if by Investigating Officer or by an objection by the prosecution.]

Defense (Blouchard): During the forensic work, was there any evidence that Manning suffered from gender identity disorder or had identity problems?

Johnson: I don’t think I could answer that, Sir. I may have come across references to Web pages, but we were not looking for that.

Defense (Blouchard): Mr. Johnson, does the name Breanna Manning mean anything to you?

Johnson: Yes.

Defense (Blouchard): What is it?

Johnson: I understand that it is an alter ego of Private Manning.

TRANSCRIBER MISSED SECTIONS OF THIS DEFENSE CROSS SEE REITMAN’S ACCOUNT

MR. MARK JOHNSON, MANTECH INTERNATIONAL CONTRACTOR WORKING FOR US ARMY CCIU IS TEMPORARILY EXCUSED.

Second appearance of Mr. Mark Johnson, Contractor for ManTech International who reports to Special Agent David Shaver, Army Computer Crimes Investigative Unit (CCIU), Article 32 Pretrial, 12/19/11 (by an anonymous journalist, ed. by Alexa O’Brien)

See Transcript | US v Pfc. Manning, Article 32 Pretrial, 12/19/11 (by an anonymous journalist, ed. by Alexa O’Brien)

UNITED STATES CALLS MR. MARK JOHNSON, MANTECH INTERNATIONAL CONTRACTOR WORKING FOR US ARMY CCIU.

Prosecution: Did you examine any other pieces of digital media?

Johnson: Forensic image of the external drive taken from Private Manning.

Prosecution: Found in his C.H.U.?

Johnson: I believe so.

Prosecution: Found something of a PowerPoint presentation and a text file.

PRESENTATION

[PowerPoint:

Operations Security (OPSEC)
PV2 Manning, Bradley

D Company, 305th Military Intelligence Battalion
Friday, 13 Jun 08]

Prosecution: What was on the text file?

Johnson: Appeared to be contact info.

PRESENTATION

[Transcriber describes as wl-press.txt. Created November 30, 2009.]

Prosecution: What was in the text file?

Johnson: Contact information for Julian Assange. “You can currently contact our investigations editor directly in Iceland. 354 862 3481 24 hour service; ask for Julian Assange.”

[Reitman notes The prosecution had no more questions on this issue, and the defense declined to cross examine.]

MR. MARK JOHNSON, MANTECH INTERNATIONAL CONTRACTOR WORKING FOR US ARMY CCIU IS TEMPORARILY EXCUSED. [BOTH REITMAN AND THE TRANSCRIBER NOTE THAT JOHNSON WAS TEMPORARILY EXCUSED, BUT HE NEVER APPEARS AGAIN IN OPEN COURT.]