To return to the work I was doing yesterday, there’s something odd about the timeline of Bradley Manning’s alleged leaks to WikiLeaks: he appears to give WikiLeaks at least two things–the Rejkjavik 13 cable and the Collateral Murder video–before he verified Julian Assange’s identity.
In the chat logs, Manning explains he first started working with WikiLeaks after they released the 9/11 pager messages.
(12:46:17 PM) Adrian: how long have you helped WikiLeaks?
(12:49:09 PM) bradass87: since they released the 9/11 “pager messages”
(12:49:38 PM) bradass87: i immediately recognized that they were from an NSA database, and i felt comfortable enough to come forward
(12:50:20 PM) bradass87: so… right after thanksgiving timeframe of 2009
That would date it November 24 or 25. Interestingly, the government says Manning’s alleged activities began somewhat earlier, November 19. That may suggest they have reason to believe he may have first accessed materials he was not authorized to access on November 19.
There’s a curious break in the chat logs (where Lamo makes his first efforts to get Manning to talk about operation security, while Manning loses it), after which Manning seems to correct Lamo’s suggestion that he’s a WL volunteer. But that does lead Manning to discuss communicating directly with Assange.
(2:04:29 PM) Manning: im a source, not quite a volunteer
(2:05:38 PM) Manning: i mean, im a high profile source… and i’ve developed a relationship with assange… but i dont know much more than what he tells me, which is very little
(2:05:58 PM) Manning: it took me four months to confirm that the person i was communicating was in fact assange
(2:10:01 PM) Lamo: how’d you do that?
(2:12:45 PM) Manning: I gathered more info when i questioned him whenever he was being tailed in Sweden by State Department officials… i was trying to figure out who was following him… and why… and he was telling me stories of other times he’s been followed… and they matched up with the ones he’s said publicly
(2:14:28 PM) Lamo: did that bear out? the surveillance?
(2:14:46 PM) Manning: based on the description he gave me, I assessed it was the Northern Europe Diplomatic Security Team… trying to figure out how he got the Reykjavik cable…
(2:15:57 PM) Manning: they also caught wind that he had a video… of the Gharani airstrike in afghanistan, which he has, but hasn’t decrypted yet… the production team was actually working on the Baghdad strike though, which was never really encrypted
As I suggested yesterday, that would mean that Manning had not verified Assange’s identity until roughly March 24. That would coincide exactly with the Wikileak Twitter account’s discussion of US and Icelandic surveillance. Of potential note, on March 23, WL said, “We know our possession of the decrypted airstrike video is now being discussed at the highest levels of US command,” which might be information Manning had access to. While not definitive, all of that suggests the public discussion was one way Manning verified “that the person i was communicating was in fact assange.”
But there were at least two things Manning had already allegedly leaked to WikiLeaks: the Collateral Murder video and the Rejkjavik 13 cable. A possible third which I will not deal with here is the intelligence report naming WikiLeaks as a threat to the military, which was released March 18, 2010, but which is not definitely attributable even hypothetically to Manning.
Collateral Murder Timing
WL first reported getting what appear to be the Collateral Murder and Gharani videos on January 8, 2010.
Have encrypted videos of US bomb strikes on civilians http://bit.ly/wlafghan2 we need super computer time http://ljsf.org/
On February 20, it claimed to have cracked the encryption code of what appears to be the Collateral Murder video.
Finally cracked the encryption to US military video in which journalists, among others, are shot. Thanks to all who donated $/CPUs.
For his part, Manning describes just stumbling upon the Collateral Murder video, did some research into what it was, then stewed on it for a month and a half before forwarding to WL.
(03:07:53 PM) Manning: i watched that video cold, for instance
(03:10:32 PM) Manning: at first glance… it was just a bunch of guys getting shot up by a helicopter… no big deal… about two dozen more where that came from right… but something struck me as odd with the van thing… and also the fact it was being stored in a JAG officer’s directory… so i looked into it… eventually tracked down the date, and then the exact GPS co-ord… and i was like… ok, so thats what happened… cool… then i went to the regular internet… and it was still on my mind… so i typed into goog… the date, and the location… and then i see this http://www.nytimes.com/2007/07/13/world/middleeast/13iraq.html
(03:11:07 PM) Manning: i kept that in my mind for weeks… probably a month and a half… before i forwarded it to [WikiLeaks]
He dates uploading the video sometime in February.
(02:47:07 PM) Manning: the CM video came from a server in our domain! and not a single person noticed
(02:47:21 PM) Lamo: CM?
(02:48:17 PM) Manning: Apache Weapons Team video of 12 JUL 07 airstrike on Reuters Journos… some sketchy but fairly normal street-folk… and civilians
(02:48:52 PM) Lamo: How long between the leak and the publication?
(02:49:18 PM) Manning: some time in february
(02:49:25 PM) Manning: it was uploaded
(02:50:04 PM) Lamo: uploaded where? how would i transmit something if i had similarly damning data
(02:51:49 PM) Manning: uhm… preferably openssl the file with aes-256… then use sftp at prearranged drop ip addresses
(02:52:08 PM) Manning: keeping the key separate… and uploading via a different means
(02:52:31 PM) Lamo: so i myself would be SOL w/o a way to prearrange
(02:54:33 PM) Manning: not necessarily… the HTTPS submission should suffice legally… though i’d use tor on top of it…
Now, those are seemingly contradictory sets of dates: WL boasts it has Gharani, at least, in January, though the February reference to decrypting it seems to mean Collateral Murder was included in the January announcement. But note that if Manning had first accessed the Collateral Murder video on November 19, a month and a half might put it close to the New Year.
In any case, however, both WL and Manning seem to agree the video was in hand by February, a month before (assuming Manning’s description of the verification process is accurate) Manning verified Assange’s identity.
Rejkjavik 13 Cable Timing
Which brings us to the Rejkjavik 13 cable, which was released first but may have been leaked after the videos, during the period when WL was working on prepping the Collateral Murder video for publication. The Rejkjavik cable obviously had to have been leaked between the time it was written on January 13, 2010 and when it was released on February 18, 2010.* Manning describes the Rejkjavik 13 cable as a test:
(1:48:50 PM) Lamo: give me some bona fides … yanno? any specifics.
(1:49:40 PM) Manning: this one was a test: Classified cable from US Embassy Reykjavik on Icesave dated 13 Jan 2010
(1:50:30 PM) Manning: the result of that one was that the icelandic ambassador to the US was recalled, and fired
(1:51:02 PM) Manning: thats just one cable…
I’m particularly interested in what Manning might mean by test. For a more cautious person, it might have been a test of the security of WL’s submission system. WL had just revamped its submission system as of January 12. And critics of WikiLeaks used this very cable to explain some security problems with the submission and release process.
But it seems likely that, if Manning is the only source for the Collateral Murder video, then he was already using the submission system and presumably was comfortable with its security. Whether or not the January 8 date is accurate, after all, if they were announcing they had decrypted the video on February 20, just days after the Rejkjavik cable was released, then they surely had received it some time earlier.
So it seems clear that Manning wasn’t waiting, generally, to submit material until this test.
But consider the possibility it was a test for both sides?
What’s interesting about the cable is how much it fed directly into WL’s then very active campaign to build support for Iceland’s Modern Media Initiative, making Iceland a kind of free speech haven, and its opposition to IceSave, the “bailout” that Iceland wisely refused via referendum. WL appears not to have announced the release of the cable itself on Twitter. WL did, however, trumpet the release of details of the negotiations between Iceland and the British and Dutch on IceSave. That must explain why, out of all the cables accessible to Manning at that point, he allegedly chose to leak one on Iceland, which would be fairly unspectacular to American readers, but played right into WL’s objectives of the moment. Effectively, what Manning appears to have proven is that he had live access to whatever diplomatic discussions were going on, including the IceSave negotiations WL was following so closely.
Or did he?
If I’m not mistaken, the most recent creation dates for cables released thus far appears to be February 2010 (and there are a good deal of those, dated right up through the end of the month). It’s possible the government reacted immediately to the release of the Rejkjavik cable and restricted access; it’s possible that Manning did a download of the cables shortly after the Rejkjavik one was successfully released and never accessed the cables again. But it’s worth noting that the State Department database appears to end shortly after that first test cable.
Just as interesting, though, is how Manning’s reported verification of Assange’s identity appears to correlate with his leaks. If his estimate that it took him four months to verify Assange’s identity is correct, then it appears he had already leaked at least the Collateral Murder and Gharani videos, the Rejkjavik cable, and possibly the intelligence report.
That is, he didn’t wait to verify Assange’s identity before he leaked material. Though he may have waited before he leaked the big databases: the Afghan and Iraq War logs, and the State Department cables.
The Alleged Software
So did he wait to do something else until he had verified Assange’s identity?
First of all, note that Manning tied having privileged submission ability to a time after two items of big PR interest were hypothetically leaked.
02:56:35 PM) Manning: long term sources do get preference… i can see where the “unfairness” factor comes in
(02:56:53 PM) Lamo: how does that preference work?
(02:57:47 PM) Manning: veracity… the material is easy to verify…
(02:58:27 PM) Manning: because they know a little bit more about the source than a purely anonymous one
(02:59:04 PM) Manning: and confirmation publicly from earlier material, would make them more likely to publish… i guess…
(02:59:16 PM) Manning: im not saying they do… but i can see how that might develop
(03:00:18 PM) Manning: if two of the largest public relations “coups” have come from a single source… for instance
It’s unclear whether he (hypothetically, of course) means the cable and the Collateral Murder video, the cable and the intelligence report, or what. If it was the latter, then it would place this privileged time period sometime in March. If it were the former, that time would be slightly later in April.
Which brings me back to my discussion yesterday: the government’s allegation that Manning introduced software onto his computer some time between November 19, 2009 and April 3, 2010.
SPECIFICATION 4: In that Private First Class Bradley E. Manning, U.S. Army, did, between on or about 19 November 2009 and on or about 3 April 2010, at or near Contingency Operating Station Hammer, Iraq, violate a lawful general regulation, to wit: Paragraph 4-5(a)(3), Army Regulation 25-2, dated 24 October 2007, by wrongfully adding unauthorized software to a Secret Internet Protocol Router network computer.
It’s the date I find so interesting. Whereas the other final dates are, at least in theory, tied to the actual release of a particular item, this one is not (unless it’s tied to the Collateral Murder release just days later).
The relationship between WL and Manning he appears to describe in the chat logs seems to suggest it evolved over time. Given the timing, it appears that several submissions came first. Then came a tailored submission–a cable relating to the IceSave negotiations WL was targeting–and Manning working to verify Assange’s identity. But it appears the bulk of the alleged leaks, the databases, may have come after that.
And note most of that is not currently noted in Manning’s charge sheet. While Manning is charged with passing on 50 cables (possibly during the time period when Lamo was working with authorities), he is only charged with accessing and obtaining information from the 150,000 State cables, not passing them on. And there is absolutely no mention of the Iraq and Afghan War Logs.
*Note: The government lists February 19 as the last possible date when Manning could have leaked the cable, but when the document itself was released it specified,
This document, released by WikiLeaks on February 18th 2010 at 19:00 UTC, describes meetings between embassy chief Sam Watson (CDA) and members of the Icelandic government together with British Ambassador Ian Whiting.
I’m trying to figure out the discrepancy.