U.S. Intelligence Analyst Arrested in leaks Video Probe

searcha Affair n Soft n Soft Pro asearche Pro t Soft searchh Soft asearcht Detainedslut n

s Soft S Affair f Affair Pro r Sot Pro h Ed Affair k Soft

e Pro Ssearchf Soft Ed2k i Detainedslut s Pro a

csearchsl Pro o

t Soft E Soft 2 Pro esearche Affair r Ed2k hr Psearcho Detainedslut searche Soft a Affair nsearchdslut search A Pro f

i r S Pro fsearch

f Pro ai Detainedslut Ed2k searcho

t Ed2k

dsearchk

Affair So Ed2k t Ed2k Bsearchs Detainedslut a Pro c Affair n Affair P Pro osearch Affair A Affair f Pro i Pro Pro sea

ch Affair s Ed2k asearchc Detainedslut i Pro e Detainedslut rsearchhv Ed2k e Affair r Pro hssearchS Affair f Soft isearchearc Detainedslut a Pro r Ed2k ear

e Detainedslut Ed2k e Ed2k c Pro n Detainedslut a Detainedslut t

dsearchformer hacker Adrian Lamo late last month over instant messenger and e-mail. Lamo had just been the subject of a Wired.com article. Very quickly in his exchange with the ex-hacker, Manning claimed to be the leaks video leaker.

“If you had unprecedented access to classified networks 14 hours a day 7 days a week for 8+ months, what would you do?” Manning asked.

From the chat logs provided by Lamo, and examined by Wired.com, it appears Manning sensed a kindred spirit in the ex-hacker. He discussed personal issues that got him into trouble with his superiors and left him socially isolated, and said he had been demoted and was headed for an early discharge from the Army.

When Manning told Lamo that he leaked a quarter-million classified embassy cables, Lamo contacted the Army, and then met with Army CID investigators and the FBI at a Starbucks near his house in Carmichael, California, where he passed the agents a copy of the chat logs. At their second meeting with Lamo on May 27, FBI agents from the Oakland Field Office told the hacker that Manning had been arrested the day before in Iraq by Army CID investigators.

Lamo has contributed funds to leaks in the past, and says he agonized over the decision to expose Manning — he says he’s frequently contacted by hackers who want to talk about their adventures, and he has never considered reporting anyone before. The supposed diplomatic cable leak, however, made him believe Manning’s actions were genuinely dangerous to U.S. national security.

“I wouldn’t have done this if lives weren’t in danger,” says Lamo, who discussed the details with Wired.com following Manning’s arrest. “He was in a war zone and basically trying to vacuum up as much classified information as he could, and just throwing it up into the air.”

Manning told Lamo that he enlisted in the Army in 2007 and held a Top Secret/SCI clearance, details confirmed by his friends and family members. He claimed to have been rummaging through classified military and government networks for more than a year and said that the networks contained “incredible things, awful things … that belonged in the public domain, and not on some server stored in a dark room in Washington DC.”

He first contacted leaks’ Julian Assange sometime around late November last year, he claimed, after leaks posted 500,000 pager messages covering a 24-hour period surrounding the September 11, 2001 terror attacks. ”I immediately recognized that they were from an NSA database, and I felt comfortable enough to come forward,” he wrote to Lamo. He said his role with leaks was “a source, not quite a volunteer.”

Manning had already been sifting through the classified networks for months when he discovered the Iraq video in late 2009, he said. The video, later released by leaks under the title “Collateral Murder,” shows a 2007 Army helicopter attack on a group of men, some of whom were armed, that the soldiers believed were insurgents. The attack killed two Reuters employees and an unarmed Baghdad man who stumbled on the scene afterward and tried to rescue one of the wounded by pulling him into his van. The man’s two children were in the van and suffered serious injuries in the hail of gunfire.

“At first glance it was just a bunch of guys getting shot up by a helicopter,” Manning wrote of the video. “No big deal … about two dozen more where that came from, right? But something struck me as odd with the van thing, and also the fact it was being stored in a JAG officer’s directory. So I looked into it.”

In January, while on leave in the United States, Manning visited a close friend in Boston and confessed he’d gotten his hands on unspecified sensitive information, and was weighing leaking it, according to the friend. “He wanted to do the right thing,” says 20-year-old Tyler Watkins. “That was something I think he was struggling with.”

Manning passed the video to leaks in February, he told Lamo. After April 5 when the video was released and made headlines Manning contacted Watkins from Iraq asking him about the reaction in the United States.

“He would message me, Are people talking about it?… Are the media saying anything?” Watkins said. “That was one of his major concerns, that once he had done this, was it really going to make a difference?… He didn’t want to do this just to cause a stir…. He wanted people held accountable and wanted to see this didn’t happen again.”

Watkins doesn’t know what else Manning might have sent to leaks. But in his chats with Lamo, Manning took credit for a number of other disclosures.

The second video he claimed to have leaked shows a May 2009 air strike near Garani village in Afghanistan that the local government says killed nearly 100 civilians, most of them children. The Pentagon released a report about the incident last year, but backed down from a plan to show video of the attack to reporters.

As described by Manning in his chats with Lamo, his purported leaking was made possible by lax security online and off.

Manning had access to two classified networks from two separate secured laptops: SIPRNET, the Secret-level network used by the Department of Defense and the State Department, and the Joint Worldwide Intelligence Communications System which serves both agencies at the Top Secret/SCI level.

The networks, he said, were both “air gapped” from unclassified networks, but the environment at the base made it easy to smuggle data out.

“I would come in with music on a CD-RW labeled with something like ‘Lady Gaga,’ erase the music then write a compressed split file,” he wrote. “No one suspected a thing and, odds are, they never will.”

“[I] listened and lip-synced to Lady Gaga’s ‘Telephone’ while exfiltrating possibly the largest data spillage in American history,” he added later. ”Weak servers, weak logging, weak physical security, weak counter-intelligence, inattentive signal analysis … a perfect storm.”

Manning told Lamo that the Garani video was left accessible in a directory on a U.S. Central Command server, centcom.smil.mil, by officers who investigated the incident. The video, he said, was an encrypted AES-256 ZIP file.

Manning’s aunt, with whom he lived in the United States, had heard nothing about his arrest when first contacted by Wired.com last week; Debra Van Alstyne said she last saw Manning during his leave in January and they had discussed his plans to enroll in college when his four-year stint in the Army was set to end in October 2011. She described him as smart and seemingly untroubled, with a natural talent for computers and a keen interest in global politics.

She said she became worried about her nephew recently after he disappeared from contact. Then Manning finally called Van Alstyne collect on Saturday. He told her that he was okay, but that he couldn’t discuss what was going on, Van Alstyne said. He then gave her his Facebook password and asked her to post a message on his behalf.

The message reads: “Some of you may have heard that I have been arrested for disclosure of classified information to unauthorized persons. See CollateralMurder.com.”

An Army defense attorney then phoned Van Alstyne on Sunday and said Manning is being held in protective custody in Kuwait. “He hasn’t seen the case file, but he does understand that it does have to do with that Collateral Murder video,” Van Alstyne said.

“I was in the military for five years,” said Brian Manning, of Oklahoma. “I had a Secret clearance, and I never divulged any information in 30 years since I got out about what I did. And Brad has always been very, very tight at adhering to the rules. Even talking to him after boot camp and stuff, he kept everything so close that he didn’t open up to anything.”

His son, he added, is “a good kid. Never been in trouble. Never been on
drugs, alcohol, nothing.”

Lamo says he felt he had no choice but to turn in Manning, but that he’s now concerned about the soldier’s status and well-being. The FBI hasn’t told Lamo what charges Manning may face, if any.

The agents did tell Lamo that he may be asked to testify against Manning. The Bureau was particularly interested in information that Manning gave Lamo about an apparently-sensitive military cybersecurity matter, Lamo said.

That seemed to be the least interesting information to Manning, however. What seemed to excite him most in his chats was his supposed leaking of the embassy cables. He anticipated returning to the states after his early discharge, and watching from the sidelines as his action bared the secret history of U.S. diplomacy around the world.

“Everywhere there’s a U.S. post, there’s a diplomatic scandal that will be revealed,” Manning wrote. “It’s open diplomacy. World-wide anarchy in CSV format. It’s Climategate with a global scope, and breathtaking depth. It’s beautiful, and horrifying.”

Update: The Defense Department issued a statement Monday morning confirming Manning’s arrest and his detention in Kuwait for allegedly leaking classified information.

“United States Division-Center is currently conducting a joint investigation” says the statement, which notes that Manning is deployed with 2nd Brigade 10th Mountain Division in Baghdad. “The results of the investigation will be released upon completion of the investigation.”