In January, I did a timeline of the key dates revealed in Manning’s July 6, 2010 charging document. I wanted to put the timeline laid out in yesterday’s charging document side-by-side with the earlier one to identify what new details there are, presumably showing us what the government has learned since July, as well as the chronology of when the government alleges Bradley Manning accessed and leaked particular documents.
Here’s what the government appears to believe happened.
Before January 8, 2010: Garani airstrike video
Based on my assumption that the video called BE22 PAX.wmv is the Garani video (see Specification 11), it appears Manning allegedly leaked that first. The government says that leak occurred by January 8, which happens to be the date when WikiLeaks said they had an encrypted video of an airstrike on civilians (note, in the past I have supposed that that was the Collateral Murder video, which appears to have been wrong). There’s nothing in the charging document that might explain how they think Manning leaked that video.
Before February 9, 2010: Iraq and Afghan warlogs
Interestingly, the government seems confident that Manning accessed both the Iraq and Afghan War logs by January 8. Wednesday’s charging sheet also describes the leak of 20 cables each from these databases possibly as early as New Years Eve in 2009, but definitely by February 9.
After February 11: Unauthorized software on SIPRNET; the Collateral Murder, Rejkjavik-13 cable, and Defense Intelligence documents
Then, remember, Manning came to the US in January to February 2010. Adrian Lamo has long alleged that Manning got help from some folks in Boston. The timeline shows Manning returned to Iraq on February 11, which also happens to be the first date Manning is alleged to have put the first of two unauthorized pieces of software onto SIPRNET.
Shortly thereafter–on February 15–is the earliest day the government thinks Manning could have leaked the Collateral Murder video, the Rejkjavik-13 cable, and the Defense Intelligence report. All of that suggests that the government believes Manning got software while in the US, loaded it onto SIPRNET when he returned to Iraq, then leaked those three documents using that software. Note, though, that the last date for when Manning allegedly added this software was April 3, right before the Collateral Murder video came out, so it may be that video is the first thing they’re sure he used the software with. In any case, the government still seems to have no idea when these documents were leaked, suggesting that the software may have prevented the government from pinpointing when Manning allegedly leaked any given document using forensics.
March 8: Gitmo documents and bypassing information security
The government seems to know precisely what day, March 8, Manning allegedly accessed what I believe are the Gitmo documents, described as 700 SOUTHCOM documents. Though as with the other documents, they don’t seem to know when he leaked them. Note that March 8 is also the first date for which the government alleges Manning “attempt[ed] to bypass network or information system security mechanisms.” Any of you tech folks have a theory about what that might have been about?
Four days in March: WikiLeaks surveillance?
Then came the leak of “more than one classified memo” from a US intelligence agency, sometime between March 22 and 26. As I’ve been suggesting, that happened at precisely the time–Manning said in chat logs–that Manning confirmed he was talking directly with Julian Assange by matching what Assange said about surveillance with the surveillance evidence Manning tracked on DOD networks. On March 23, WL announced that, “We know our possession of the decrypted airstrike video is now being discussed at the highest levels of US command.” And in his discussion with Lamo, Manning also mentioned the government’s discussion of the airstrike video:
(2:14:46 PM) Manning: based on the description he gave me, I assessed it was the Northern Europe Diplomatic Security Team… trying to figure out how he got the Reykjavik cable…
(2:15:57 PM) Manning: they also caught wind that he had a video… of the Gharani airstrike in afghanistan, which he has, but hasn’t decrypted yet… the production team was actually working on the Baghdad strike though, which was never really encrypted
Which seems to suggest these intelligence memos may have related to the government’s surveillance of WikiLeaks itself. (Note, I’m not actually sure that Diplomatic Security qualifies as an intelligence agency; it’s possible the US command reference came from something else, something more clearly an intelligence agency.)
Mid-February, then after March 28: The State Department cables
The State Department cables appear to have come next.
As noted above, the government put the window for Manning to have accessed and leaked the Rejkjavik-13 cable–what he called “a test”–between February 15 and 18. (In chat logs, Manning noted that, “the result of that one was that the icelandic ambassador to the US was recalled, and fired,” so it may be by “test” they were trying to assess how the diplomatic community would respond to a leak of one of these cables or possibly even elicit more information about what those cables were.)
The charging document puts the first date he may have accessed the State Department cables on March 28. So they’re claiming that Manning went and got the Rejkjavik cable, leaked it, and then went back and got the entire database.
The dates on these may also tell us something about the cables. The Rejkjavik-13 cable is dated January 13; the government lists February 15 as the first date Manning might have accessed it–so Manning accessed it just over a month after it was written. The last date from which we have State cables is February 28, 2010; the government lists the first date when Manning accessed the entire database as March 28, exactly a month later the last cables that have been leaked were written. Is it possible that the State Department cables only became accessible to Manning a month after they were first written?
If I’m not mistaken, the State Department cables are the only ones for which Manning is accused of exceeding his authorized access:
having knowingly exceeded authorized access on a Secret Internet Protocol Router Network computer, and by means of such conduct having obtained information that has been determined by the United States government pursuant to an Executive Order or statute to require protection against unauthorized disclosure for reasons of national defense or foreign relations
This suggests two things. First, the State cables appear to be the only thing that Manning, as an Army intelligence analyst, didn’t already have authorized access to. This sort of makes sense, since everything else appears to have belonged to DOD. But it also might mean that the government is crafting this charge with the possibility of piling on later–perhaps with an Espionage charge if they can ever tie Manning to Julian Assange?
After April 11: Garani documents
WikiLeaks never released the Garani video Manning purportedly leaked. So we may never learn what WikiLeaks intended to do with it. But in chat logs, here’s how he described the video and related material.
(2:15:57 PM) Manning: they also caught wind that he had a video… of the Gharani airstrike in afghanistan, which he has, but hasn’t decrypted yet… the production team was actually working on the Baghdad strike though, which was never really encrypted
(2:16:22 PM) Manning: he’s got the whole 15-6 for that incident… so it wont just be video with no context
(2:16:55 PM) Manning: but its not nearly as damning… it was an awful incident, but nothing like the baghdad one
(2:17:59 PM) Manning: the investigating officers left the material unprotected, sitting in a directory on a centcom.smil.mil
(2:18:03 PM) Manning: server
(2:18:56 PM) Manning: but they did zip up the files, aes-256, with an excellent password… so afaik it hasn’t been broken yet
(2:19:12 PM) Manning: 14+ chars…
I find this interesting given that the government alleges Manning leaked “more than five classified records” related to the Garani airstrike (we know it was Garani by the date and location) sometime after April 11–that is, 4 months after they believe Manning leaked the video itself (again, assuming the BE22 PAX.wmv is the Garani video). While it’s possible Manning was trying to get something that might help WL decrypt the video, given the reference to “records,” I suspect these documents are the 15-6 investigation documents. It appears Manning was trying to provide context for the Garani strike, which resulted in the killing of up to 140 civilians. Note, too, that April 11 would have been just after WikiLeaks released the Collateral Murder video, so it may be that Manning was trying to find similar context for the events depicted in the video.
Early May: A new computer and the global address list?
Note, for some of the documents Manning is alleged to leak–the Gitmo documents, the Garani documents, and the State Department cables–the government just gives May 27 as the last day he might have leaked them. That is, they claim to know he leaked them before they arrested him, but are not certain precisely when he did leak them. But it appears they think he got everything he was going to leak earlier.
The exception is the Outlook global address list, which Manning is alleged to have gotten after May 11. (See William Ockham’s comment for what the address list may have allowed Manning to do.)
The date the government alleges Manning accessed that list is one week after they allege he added a second piece of unauthorized software to SIPRNET on May 4.
And both of those dates are in the general time frame when Manning assaulted a colleague and was demoted.
Now, I’ve still got a lot of questions about this time frame. But one possibility is that the May 4 date reflects a new computer assignment, possibly tied to his demotion (though he still had access to SIPRNET on May 4; it’d be surprising that he still had access after his demotion). And I wonder whether Manning didn’t access the global address list as he grew increasingly frustrated with his plight?
In other words, it appears that after getting the Garani documents (and after the release of the Collateral Muder video), Manning’s active access and leaking of documents tailed off. In other words, it appears that it was almost two months between the time Manning stopped actively leaking and the time the Army arrested him.