Witness | US v Pfc. Manning, Special Agent Alfred Williamson, CCIU

  • posted December 20, 2011

UPDATE POST COURT-MARTIAL

United States v. Pfc. Manning was conducted in de facto secrecy. The public was not granted contemporaneous access to court filings or rulings during her trial. In addition to reporting on her trial, I transcribed the proceedings, reconstructed the censored appellate list, and un-redacted any publicly available documentation, in order to foster public comprehension of her unprecedented trial.

As a result of a lawsuit against the military judge and the Military District of Washington brought by the Center for Constitutional Rights, as well as my own FOIA requests and research, an official court record for US v. Pfc. Manning was released seven months after her trial. That record is not complete.

The official trial docket is published HERE and the entire collection of documents is text searchable at usvmanning.org.

*During the pretrial proceedings, court-martial and sentencing of Pfc. Manning, Chelsea requested to be identified as Bradley and addressed using the male pronoun. In a letter embargoed for August 22, 2013 Chelsea proclaimed that she is female and wished to be addressed from that moment forward as Chelsea E. Manning.

General Description

Special Agent Alfred Williamson, CCIU is a digital forensic investigator with the Army Computer Crimes Investigative Unit (CCIU) since 2006. Special Agent David Shaver is Williamson’s supervisor at CCIU.

Special Agent Alfred Williamson, CCIU primarily examined the NIPRNet computer from the Supply Room at FOB Hammer, Iraq and “additional items”. Some of those additional items are identified on the defense’s 2 December 2011 Request for Article 32 Witnesses. They include: PFC Manning’s cellular telephone, the computer assigned IP address XXXXXXXXXX [WHAT IS THIS? IS THIS PETER BIGELOW’S PERSONAL LAPTOP?] and the forensic imaging of the WikiLeaks website. Williamson testified that his investigation concerned the unclassified information in the case.

Special Agent Alfred Williamson, CCIU testified that he started his investigation of the Supply Room NIPRNet computer by verifying that the EnCase forensic image matched. Williamson testified that the NIPRNet computer did not require a CAC [Common Access] Card to access. Williamson was not clear on whether the NIPRNet computer required a password to access.

Special Agent Alfred Williamson, CCIU testified that he located a user account for Manning created on 21 May 2010 and an Internet history for that user profile. Williamson testified that he found evidence that Manning’s Google Gmail account had been accessed from the NIPRNet Supply Room computer. Williamson testified that he located Google searches for the term WikiLeaks, and Open-Closed Article 15 [Non-Judicial Punishment] hearing; and a Web history of Web pages about Article 15 [Non-Judicial Punishment].

Special Agent Alfred Williamson, CCIU testified that he was approached by Special Agent David Shaver, his supervisor at CCIU to re-examine the Supply Room NIPRNet machine and the forensic image of that computer to look at information related to United States Forces – Iraq Microsoft Outlook Share Point Exchange Server global address list (GAL). Reitman notes that Williamson testified that “[h]e searched for the keyword string related to 2BCT10MNT.” Reitman also notes that Williamson testified that “[h]e used EnCase to search for related text files.” Williamson testified that he found “extracts” from United States Forces – Iraq Microsoft Outlook Share Point Exchange Server global address list (GAL) in five or six text files, all different sizes under Staff Sergeant Peter Bigelow’s account. Williamson testified that the files contained .mil email addresses, domain names, unit names, and the names of individuals. Williamson testified that three of the files that he found would have been 2,000 pages long if they were printed out. One of the files of extracts from United States Forces – Iraq Microsoft Outlook Share Point Exchange Server global address list (GAL) was found in “My Docs” the remaining were found in the “Recycle Bin”. On cross examination, Williamson admitted that the Global Address List (GAL) was unclassified and unencrypted, and that there was no forensic evidence on the NIPRNet computer that the Global Address Information (GAL) was extracted or removed: “Forensics would indicate it is likely that it was removed. Cannot say definitively.”

Special Agent Alfred Williamson, CCIU testified that he also found two .zip files in the “Recycle Bin” and that both files had similarities to the five or six text files of extracts from the United States Forces – Iraq Microsoft Outlook Share Point Exchange Server global address list (GAL). Reitman notes that these two .zip files “followed the same naming convention” as the five of six .txt files found with extracts of the United States Forces – Iraq Microsoft Outlook Share Point Exchange Server global address list (GAL).

Special Agent Alfred Williamson, CCIU testified that he found “Tmp.pdf” in the “Recycle Bin” of the profile for Staff Sergeant Peter Bigelow, which consisted of 18 pages of counseling records for Pfc. Manning including UMCJ [Uniform Code of Military Justice] statements.

Special Agent Alfred Williamson, CCIU testified that Internet searches on Staff Sergeant Peter Bigelow’s account included the terms “WikiLeaks”, “Julian Assange”, “Global Address List (GAL)”, “Microsoft Excel”, “Macro Outlook”, “BBA Outlook” and others that were missed by the transcriber and by Reitman. Williamson testified that the searches indicated to him that Pfc. Manning was allegedly trying to extract information from the Global Address List (GAL) and save it to a file.

Special Agent Alfred Williamson, CCIU testified that he found the index.dat under Staff Sergeant Peter Bigelow’s account which included a cache Web page which evidenced that Manning’s Army Knowledge Online Account was accessed under that profile. Williamson testified that he found, in the index.dat under Staff Sergeant Peter Bigelow’s account, a cache of a Google search Web page that evidenced “bradley.e.manning@gmail.com” Google Gmail account had been accessed from that profile. Williamson testified that he found in the index.dat under Staff Sergeant Peter Bigelow’s account a cache Web page for Amazon.com that evidenced that the logged-in user was Pfc. Manning and included an invoice from Amazon.com with Manning’s billing address at his aunt Deborah Van Alstyne’s residence in Potomac, MD. On cross examination, Williamson explained that he found a book had been ordered on Manning’s Amazon account concerning the subject of “feminine facial surgery.” The book had shipped to the address of aunt Deborah Van Alstyne’s residence in Potomac, MD.

Special Agent Alfred Williamson, CCIU testified that the searches for the Global Address List (GAL) preceded the creation of the text files that contained extracts of the Global Address List (GAL), and the creation of the text files that contained extracts of the Global Address List (GAL) occurred within a minute or two of access to the “bradley.e.manning@gmail.com” Google Gmail account.

Special Agent Alfred Williamson, CCIU testified that he found evidence of a Google search for “gender identity disorder” and a cache Wikipedia page about “adjustment disorder.” Reitman notes that Williamson could not recall of he found items related to Breanna Manning.

Special Agent Alfred Williamson, CCIU testified that he stood by his report on the Supply Room NIPRNet computer. On cross examination, Williamson testified that forensics showed that Manning’s account was created on 21 May 2010. When defense asked Williamson if forensics showed when Manning’s account was last accessed, Williamson answered: “Accessed by a user is one thing, but Microsoft tends to access a lot of files. So sometimes it is difficult to tell whether it was the user or the OS that accessed a file.” Defense asked Williamson if he stood by his report which stated that Manning’s account was last accessed on May 28, 2010. Williamson asked to see the report and then said that he stood by his own words. Defense then asked Williamson if he knew that Manning was detained under guard at FOB Hammer on 27 May 2010, to which Williamson answered that he did not know that.

No. 6 on the December 2, 2011 Defense Request for Article 32 Witnesses

6.) XXXXXXXXXX [SPECIAL AGENT ALFRED WILLIAMSON] A forensic examiner who examined the U.S. Government Supply Annex NIPRNET computer (Unclassified), utilized by PFC Manning. He will testify about the nature of his forensic examination and the results of his examination. He will also testify about his forensic analysis and evidence collection from PFC Manning’s cellular telephone, the computer assigned IP address XXXXXXXXXX [WHAT IS THIS?] and the forensic imaging of the WikiLeaks website.

Individuals named in the testimony of Special Agent Alfred Williamson, Army Computer Crimes Investigative Unit (CCIU)

  • Special Agent David Shaver, CCIU
  • Staff Sergeant Peter Bigelow, Supply Room
  • Debra Van Alstyne, Manning’s aunt.

Evidence named in the testimony of Special Agent Alfred Williamson, Army Computer Crimes Investigative Unit (CCIU)

  • NIPRNet computer from the Supply Room at FOB Hammer, Iraq
    • Manning’s account on the NIPRNet computer from the Supply Room at FOB Hammer, Iraq
      • Evidence that Manning’s Google Gmail account had been accessed on the Supply Room NIPRNet computer.
      • Evidence of Google searches for the term WikiLeaks, Open-Closed Article 15 [Non-Judicial Punishment], and gender identity disorder
      • Web history of Web pages about Article 15 [Non-Judicial Punishment]
    • Staff Sergeant Peter Bigelow’s account
      • Five (5) or six (6) text files with extracts from United States Forces – Iraq Microsoft Outlook Share Point Exchange Server global address list (GAL) under Staff Sergeant Peter Bigelow’s account. One (1) of the files was in “My Docs”; the remaining were in the “Recycle Bin”.
      • Two (2) .zip files in the “Recycle Bin” of Staff Sergeant Peter Bigelow’s account had similarities to the five or six text files of extracts from the United States Forces – Iraq Microsoft Outlook Share Point Exchange Server global address list (GAL), because they followed the same naming convention.
      • “Tmp.pdf” in the “Recycle Bin” of Staff Sergeant Peter Bigelow’s account that consisted of 18 pages of counseling records for Pfc. Manning including U.M.C.J. [Uniform Code of Military Justice] statements.
      • Internet searches on Staff Sergeant Peter Bigelow’s account.
      • Internet Explorer index.dat
        • cache of Army Knowledge Online Web page evidencing Manning’s account was accessed.
        • cache of a Google Search Web page evidencing Manning’s “bradley.e.manning@gmail.com” Google Gmail account was accessed.
        • cache of a Wikipedia page on “adjustment disorder”
        • Google Home Page evidencing Manning’s account was accessed.
          • Screenshot of a Google Search Web Page for the term “Global Address List Macro Outlook” [Bates Number 00409679]
          • Screenshot of Web Page of what would have been allegedly seen if one were to click on the first result of the Google Search for the term “Global Address List Macro Outlook” [Bates Number 00410555]
        • cache of a Amazon.com invoice Web page evidencing Manning’s account was accessed.
  • Manning’s Amazon Account.
  • Manning’s Google Account.
  • Manning’s Army Knowledge Online Account
  • unnamed additional items examined by Special Agent Alfred Williamson, CCIU
  • PFC Manning’s cellular telephone.
  • Computer assigned IP address XXXXXXXXXX [WHAT IS THIS? IS THIS PETER BIGELOW’S PERSONAL LAPTOP?]
  • Forensic imaging of the WikiLeaks website.

Special Agent Alfred Williamson, CCIU testimony at US v Pfc. Manning, Article 32 Pretrial Hearing, 12/20/11

See Transcript of US v Pfc. Manning, Article 32 Pretrial Hearing, 12/20/11

US CALLS SPECIAL AGENT ALFRED WILLIAMSON, CCIU

Prosecution: [Missed question.]

Williamson: I started working for CCIU in September 2006. I am a special agent and digital forensics investigator. Special Agent David Shaver is my supervisor. From 2002 to 2006 I was deployed with the Department of Immigration for the Department of Homeland Security. From 1992 to 2002 I was a police officer, a criminal investigator in Texas.

Prosecution: What training do you have in forensics examination?

Williamson: While at the Department of Homeland Security I attended three courses in nine weeks at the end of which I was designated computer forensics agent [missed where]. Initial portion was Computing Technology Industry Association (CompTIA) A+ Certification [talks about what the training entailed: OS’s, troubleshooting,..] That was DHS training.

Prosecution: What training under CCIU?

Williamson: Numerous courses. [Williamson talks about having three certifications that are issued by the military. Other certifications: CompTIA A+, Nework +, [missed another], Certified Ethical Hacker, Windows Vista Certification.

Prosecution: Did you examine digital media? What did you examine?

Williamson: Primarily the supply NIPRnet computer and additional items.

Prosecution: What process did you go through?

Williamson: Initially, I took the working copy of evidence I had and loaded into forensics software EnCase. Verified that the evidence I am examining is the exact same as when it was imaged.

Prosecution: What did you find?

Williamson: During initial search, I located a user account for Manning and an Internet history for that user profile. May 21, 2010.

Prosecution: What activity did you see?

Williamson: I located a Google search for the term WikiLeaks. Open-Closed Article 15 [Non Judicial Punishment] hearing; also the Web history for the Web page linked to Article 15; Google Gmail account access.

Prosecution: And, what prompted you to look at the computer?

Williamson: I was approached by Agent [David] Shaver, [CCIU] to re-examine the machine and the image of that computer, and to look at the information related to [United States Forces – Microsoft Outlook Share Point Exchange Server global address list (GAL)] Iraq [missed the rest].

Prosecution: First thing you did?

Williamson: Primary was looking for keywords, some of which had been provided. One was a string of text for 2BCT10MNT, 2nd Brigade Combat Team, 10th Mountain Division. During the second search, I looked for text files that appeared to be extracts.

[Reitman notes, “At the prompting of his supervisors, Williamson did a more extensive search, focusing this time on information relating to the Global Address List (GAL) for Iraq. He searched for a keyword string related to 2BCT10MNT.”]

Prosecution: Why do you say that?

Williamson: Five to six text files, all different sizes, all different. Contained .mil email addresses or domain names or unit names.

Prosecution: Individuals’ names?

Williamson: Yes.

Prosecution: You said two to four text files in Peter Bigelow user account?

Williamson: Don’t remember size, but it would take over 2,000 pages to print them out.

[Reitman notes, “While he could give a size estimation for the files, he said that three of the files he discovered would have been 2,000 page printed (each of the three, not all three together).”]

Prosecution: Where did you find text files?

Williamson: One in “My Docs”; remaining in the recycle bin.

Prosecution: Anything else in the “Recycle Bin” of interest?

Williamson: Two .zip files. Both had similarities to the text files. There was a Tmp.pdf also in the “Recycle Bin”. Those were [18 pages] of counseling records for Pfc. Manning including U.M.C.J. [Uniform Code of Military Justice] statements.

[Reitman says, “The recycle bin also had zip files that followed the same naming convention of the found extracts of the GAL.”]

Prosecution: Internet searches on Peter Bigelow account?

Williamson: Searches for WikiLeaks, Julian Assange, Global Address List (GAL), Microsoft Excel, Macro Outlook, [missed others].

Prosecution: What did those searches indicate to you?

Williamson: The last three having to do with the Global Address List indicated he was trying to extract information from the Global Address List (GAL) and save it to a file. Under Peter Bigelow’s account, there was access to the Army Knowledge Online Account for Manning’s profile. There was also access to the bradley.e.manning Gmail account; also a Web page for Amazon.com where the logged-in user was Manning. Google search page showing Manning’s Gmail account; invoice from Amazon.com where Manning was listed as billing address.

Prosecution: You said Web pages?

Williamson: Yes, cache Web pages. So the browser downloads a copy of page so that a Web site is stored if it is visited frequently. Internet activity is located in the index.dat file in the Internet Explorer history record.

Prosecution: Account activity. Any temporal relation?

Williamson: Searches for the Global Address List was one of the first things. Then there were the creation of files containing Global Address List extracts with administrative access to the Manning Gmail account.

Prosecution: One moment please…

PROSECUTION SHOWS SPECIAL AGENT ALFRED WILLIAMSON, CCIU DOCUMENTS

[Williamson explains the documents he has been given by the prosecution.]

[Reitman notes that that Williamson describes the pages thusly:

Document 1: Cached Web pages and a Google homepage with a logged-in user, Manning.

Document 2: Screenshot of a Google search for the Global Address List Macro Outlook. Document I.D. 00409679.

Document 3: A screenshot that displayed what would be seen if someone clicked on the first result after the Google search above. Document I.D. 00410555.]

DEFENSE EXAMINES SPECIAL AGENT ALFRED WILLIAMSON, CCIU DOCUMENTS

Defense (Kemkes): Agent Williamson, your work was only on unclassified information?

Williamson: Yes.

Defense (Kemkes): The computer you used didn’t require a password?

Williamson: No.

[Reitman notes, “On questioning, Williamson noted that a CAC [Common Access] card was not needed to log into the computer. Williamson was not sure if a password was required.”]

Defense (Kemkes): You talked about a Global Address List?

Williamson: Yes.

Defense (Kemkes): File was saved under “My Docs” folder?

Williamson: One of the files.

Defense (Kemkes): Not encrypted or hidden in any way?

Williamson: No. I would say, “No.”

Defense (Kemkes): All you had to do was click on “My Docs”?

Williamson: Yes.

Defense (Kemkes): Global Address List was never removed from this computer?

Williamson: I cannot say definitively, “Yes” or “No” whether it was extracted.

Defense (Kemkes): As far as you know, it was created and then saved on that computer?

Williamson: Context I have is that it is likely that it was removed. Forensics would indicate it is likely that it was removed. Cannot say definitively.

Defense (Kemkes): You also testified on searches for WikiLeaks, Julian Assange. You also found searches on gender identity disorder and [another Web page concerning adjustment disorder]?

Williamson: [Missed answer.]

Defense (Kemkes): You found something on Breanna Manning.

Williamson: Negative. I don’t recall anything on that name.

Defense (Kemkes): You did mention that you found a book?

Williamson: Yes.

Defense (Kemkes): That book was on feminine facial surgery? You said it was sent to Potomac, Maryland?

Williamson: That was the address.

Defense (Kemkes): During the investigation, you prepared a lengthy report on your findings on a NIPRnet comp?

Williamson: Yes.

Defense (Kemkes): You stand by the findings?

Williamson: Yes.

Defense (Kemkes): You can tell when a user profile is created?

Williamson: There are a couple ways. What I had said was that, that account was created 21 May [2010].

Defense (Kemkes): So you can tell when an account was created using forensics tools?

Williamson: Yes.

Defense (Kemkes): And accessed?

Williamson: Yes and no. Accessed by a user is one thing, but Microsoft tends to access a lot of files. So sometimes it is difficult to tell whether it was the user or the OS that accessed a file.

[Reitman notes, “Kemkes asked if Williamson stood by his report that the Manning account was last accessed on 28 May 10. Williamson asked to view the report, and ultimately stood by the words there.”]

Defense (Kemkes): So you reported that it was last accessed May 28, 2010. Are you aware my client was placed under arrest on 27 May?

SPECIAL AGENT ALFRED WILLIAMSON, CCIU DOCUMENTS PERMANENTLY EXCUSED

Other Resources