Bradley Manning and ‘Nathaniel Frank’ – The U.S. Government’s case against WikiLeaks

On the 28th February 2013, at Fort Meade, Maryland, Bradley Manning pleaded guilty to ten of 22 charges the U.S. Army had brought against him. Each of these offences carries a sentence of up to two years’ imprisonment, making a total of 20 years in prison. Any sentence is to be reduced by 112 days after Colonel Denise Lind, the presiding judge, ruled that Manning had suffered excessively harsh treatment during his pre-trail detention at Quantico marine base in Virginia from 29 July 2010 to 20 April 2011. Manning also pleaded not guilty to 12 other charges, which included a charge of ‘aiding the enemy’ (which carries a potential death penalty), and a charge that falls under the Espionage Act. Bradley Manning read a 35-page statement to the court detailing and explaining his actions and his motives for disclosing what he “believed, and still believe.. are some of the most significant documents of our time.”

The government, however, argued a motion (26th February) objecting to parts of the plea and had a problem with Manning reading his statement to the court. From a report by Kevin Gosztola:

“Morrow [US govt prosecutor] went over some of the portions in the statement that the government specifically objects to being read in court. One of them talks about “staying in contact” with Nathaniel and how Manning thought he was “developing a friendship”. They would talk about not only the publications WikiLeaks was working (on). He later realized he valued the friendship himself more than Nathaniel. (‘Nathaniel Frank’, the name on the account the government has claimed was being used by WikiLeaks editor-in-chief Julian Assange, though no actual proof of him sending messages to Manning has been presented).

The judge asked how this would be prejudicial if he talked about it. Morrow said he couldn’t articulate why. The judge decided she would go through and look at portions. The government should look at portions and, if they find aspects that suggest conduct that would bring discredit to the military, raise it in court.”

The U.S. government’s objection to a section of Bradley Manning’s statement (which describes his contact with ‘Nathaniel Frank’) being read out in the courtroom and their refusal to explain why they objected, indicates that it might severely damage the U.S. government’s Grand Jury case against Julian Assange and WikiLeaks. In the end, despite the objections, Manning was permitted to read out the ‘Nathaniel Frank’ section. It appears that Manning understood ‘Nathaniel Frank’ to be a senior member of WikiLeaks codenamed ‘Ox’ and that Manning later came to believe that ‘Ox’ was either Julian Assange or Daniel Domscheit-Berg. Manning says that he encouraged ‘Ox’ to use the handle ‘Nathaniel Frank,’ who, in real life, is a U.S. Army veteran campaigner for Don’t Ask Don’t Tell and author of “Unfriendly Fire: How the Gay Ban Undermines the Military and Weakens America”.

On the 19th December 2011 (day four of the pre-trial hearing), prosecutors disclosed three excerpts of alleged Bradley Manning (who was using the name ‘nobody’) and ‘Nathaniel Frank’ chat logs. They had been taken from 14 to 15 pages of chats (.XML format), which had been recovered from an unallocated space on the hard drive of Bradley Manning’s Macintosh laptop by Mark Johnson, a digital forensics contractor for ManTech International who works for the Army’s Computer Crime Investigative Unit. Mark Johnson was able to decrypt the chat logs when it was discovered that Manning’s laptop login password ‘TWink1492!!’ was also used as the encryption key.

Bradley Manning allegedly used the Adium chat program and had attached Julian Assange’s name to the chat handle ‘dawgnetwork@jabber.ccc.de’ (ccc.de refers to the Chaos Computer Club). This is the Jabber address domain name mentioned in the infamous Bradley Manning / Adrian Lamo chat log which was turned over to U.S. Army authorities by Adrian Lamo:

(8:03:29 AM) bradass87: he does use OTR though… but discusses nothing OPSEC

(8:03:42 AM) info@adrianlamo.com: I cornered Ashcroft IRL, in the end.

(8:04:19 AM) bradass87: he *might* use the ccc.de jabber server.. but you didn’t hear that from me

(8:04:33 AM) info@adrianlamo.com: gotcha

Bradley Manning’s buddy list also contained a second handle, ‘pressassociation@jabber.ccc.de,’ which had two names attached to it: Julian Assange and ‘Nathaniel Frank’. In testimony, Mark Johnson thought that it was odd to assign two names to a single Jabber account, and implied that there was something significantly untoward in such an anomaly.

During the night shift at SCIF (Joint Operations Center/Secure Compartment Information Facility) in Iraq, Bradley Manning allegedly burned a CD containing the JTF-GITMO documents (classified assessment reports about Guantanamo Bay detainees) which he then uploaded to WikiLeaks. The chat logs between ‘nobody’ and ‘Nathaniel Frank’ (8th March 2010) contain a request to re-send some unspecified data as well as the use of SFTP for uploading data securely to an FTP server. Mark Johnson believes this means that the parties had communicated before. Mark Johnson also testified that SSH logs show this FTP server has an IP address (88.80.17.761) associated with a Swedish ISP called PRQ which he believes is, in turn, associated with WikiLeaks.

Nobody: Anyway I’m throwing everything I got on JTF-GTMO at you now.. should take a while to get up though

Nathaniel Frank: OK, great

Nobody: Uploaded about 36 pct.

Nathaniel Frank: ETA?

Nobody: 11-12 hours, guessing since it’s been going 6 already

In another chat log (which has not been fully reproduced by any media outlet that has cited it), ‘nobody’ asks ‘Nathaniel Frank’ to help him crack the password on his SIPRnet computer and states that this involves IM NT hashes (there is no such thing as IM NT hashes, but it is possible that this is a typo for NTLM – Microsoft NT LAN Manager). This is supposedly so that he can log on to the system without leaving any traces of his activity. ‘Nathaniel Frank’ replies that “yes” he has experience of such things and that they use “rainbow tables” to open hashes. Mark Johnson then stated that “nobody” then sent ‘Nathaniel Frank’ something that appeared to be a hash and tellingly does not mention anything being sent back.

Based on prior court discussions and rulings in open sessions, we might anticipate that Manning will plead not guilty as charged to:

Specification 1, Charge III – ‘In that Private First Class Bradley E. Manning, US Army, did, at or near Contingency Operating Station Hammer, Iraq, between on or about 1 November 2009 and on or about 8 March 2010, violate a lawful general regulation, to wit: paragraph 4-5(a) (4), Army Regulation 25-2, dated 24 October 2007, by attempting to bypass network or information system security mechanisms.’

With regard to: Specification 1, Charge III – government attorney Capt. Ashden Fein stated that the State Department server had logged 794,000 connections from Bradley Manning’s SCIF computer, which recorded “minute-to-minute” the transfer of 250,000 cables (which allegedly took “all of his working hours over 10 days” to download) as well as Bradley Manning’s searches of the Pentagon’s SIPRNet (it is alleged that data-mining software “unauthorized software” [Wget] was used on two occasions) and that there was direct evidence of Bradley Manning uploading the documents to WikiLeaks.

Simple deduction shows that ‘Nathaniel Frank’ (no evidence has been submitted showing that this is in fact Julian Assange or anyone else associated with WikiLeaks) did not assist Bradley Manning’s alleged attempts to bypass the SIPRNet security system because Bradley Manning never made any attempt to do this or to hide his activities. In the 35-page personal statement read out to the court on the 28th Febuary, Bradley Manning stated “I never hid the fact that I downloaded copies of CIDNE-I (Iraq War Logs) and CIDNE-A (Afghan War Diary) and burned them onto CDs”. Manning said that he did this as a normal “part of his work,” making back-ups for when the system crashed and for faster searching. He stored the CDs “in the open” at his unit’s tactical operations center and did not hide his use of downloaded compression software to help facilitate the transfer.

The only available material on the three ‘Nathaniel Frank’ chat logs (Bradley Manning’s personal statement does not address the content of the logs) was published by the mainstream press. It is extremely difficult to interpret the fragmented source material – independent of the source material’s housing – which is clearly constructed to convey the impression that ‘Nathaniel Frank’ is definitely Julian Assange and that the chat log is the ‘smoking gun’ of his assistance to Bradley Manning in gaining access (in many reports it is suggested that SIPRNet was hacked by Manning) or anonymous access. Putting the fragments together in a more realistic pattern suggests this:

2:15:57 PM) bradass87: they also caught wind that he (Julian Assange) had a video.. of the Gharani airstrike in Afghanistan (which killed nearly 100 civilians, most of them childrenthis file was later deleted by Daniel Domscheit-Berg to the immense relief of the Pentagon), which he has, but hasn’t decrypted yet.. the production team was actually working on the Baghdad strike though, which was never really encrypted.

The conversation between ‘Nathaniel Frank’ and Bradley Manning that seems to fit Specification 1, Charge III – most likely relates to decrypting data already transferred to WikiLeaks. By the time this conversation took place (8th of March 2010), Bradley Manning had already accessed and leaked material from SIPRNet numerous times. U.S. prosecutors say that the Gharani airstrike video (BE22 PAX.wmv) was leaked first, most likely occurring by 8th January 2010, and so to attempt to hide future activity was by then absurd. Bradley Manning’s access level was not unusual; 4.2 million U.S. military, federal employees, contractors, and consultants have security clearances for SIPRNet which had been ‘opened up’ post 9/11 to enable sharing across the so-called ‘intelligence community’ – there was no need for him to hack into it. The U.S. government’s second-highest level of classified information, “Secret”, is held on SIPRNet, “Top Secret” information is shared via the Joint Worldwide Intelligence Communications System (JWICS). Bradley Manning would have had to hack into JWICS to access its data, but he did not.

According to Bradley Manning’s plea statement, he interpreted his relationship with ‘Nathaniel Frank’ as being one of “friendship”. However, this was an entirely subjective perspective on the part of Manning, the initial circumspect nature of ‘Nathaniel Frank’s interaction with Manning indicates the professional approach of a journalist dealing with an anonymous source. Later the communication was mostly one way, with ‘Nathaniel Frank’ replying in a polite and sympathetic manner. In Bradley Manning’s statement he tells his story about ‘Nathaniel Frank’, saying that while he “enjoyed the ability to discuss pretty much anything, in retrospect, I realize these dynamics were artificial. They were valued more to me than Nathaniel”.

(2:05:38 PM) bradass87: i mean, im a high profile source.. and i’ve developed a relationship with assange.. but i dont know much more than what he (‘Nathaniel Frank’) tells me, which is very little

Bradley Manning also stated “No one associated with the WLO [WikiLeaks Organization] pressured me to give them more information. The decision to give documents to WikiLeaks [was] mine alone”. Manning said he took “full responsibility” and that he wanted the information to become public “to make the world a better place”.

The UN special rapporteur on torture Juan Mendez, formally accused the U.S. government of cruel, inhuman and degrading treatment towards Bradley Manning after a 14-month investigation. The most likely reasoning behind this treatment was to coerce Bradely Manning into providing the U.S. government with evidence against WikiLeaks. This appalling tactic failed. It now appears that his interactions with WikiLeaks can provide little of interest to those pursuing Julian Assange and WikiLeaks. Further, Bradely Manning is not the type of character who would provide false evidence to the U.S. government out of self-interest or from being mentally and emotionally broken.

Until the ‘Nathaniel Frank’ chat logs are fully disclosed, forensically tested and verified by independent experts, we will not know for certain the truth of the U.S. government’s case against Julian Assange. This evidence will almost certainly be disclosed and tested during Bradley Manning’s full court-martial, which is due to begin in June 2013. Charges of “conspiracy to commit espionage” and “soliciting or encouraging” Bradley Manning to commit crimes will either fall apart or persist around the ‘Nathaniel Frank’ logs.

Michael Ratner, lawyer for Julian Assange and WikiLeaks was at Bradley Manning’s plea hearing: “There were two people [in the court] who were identified to me as lawyers on the grand jury that’s sitting in Virginia. That tells us that the grand jury is still active and ongoing, and that they are still after Julian Assange and WikiLeaks.”

The grand jury investigation of WikiLeaks began on the 29th November 2010, when U.S. Attorney-General Eric Holder stated that the Justice Department was pursuing “an active, ongoing criminal investigation” into WikiLeaks. More than 250,000 U.S. State Department cables had been released by WikiLeaks the day before. That as part of this investigation, eight FBI agents arrived unannounced on a private jet in Iceland on the 24th August 2011 to interview a WikiLeaks associate (who sold t-shirts to raise funds for the organization), only to be told by Interior Minister Ögmundur Jónasson to “pack their bags, embark the plane and leave the country”, shows a certain desperation. Ögmundur Jónasson also stated in the Alþingi (the Icelandic parliament), that the FBI had intended to use the teenager they questioned, Sigurður Þórðarson (aka Siggi ‘the hacker’), as bait in their investigation of WikiLeaks. Þórðarson has stated that, despite five days of ‘questioning’, he refused to work for the FBI. The Icelandic Commissioner of the National Police and the Icelandic State Prosecutor are currently investigating violations against the Icelandic state by the FBI. Such antics suggest that the ‘Nathaniel Frank’ logs and other forensic evidence amount only to evidence of serious journalism.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s