Investigators said they found evidence Army Pfc. Bradley Manning downloaded thousands diplomatic cables, Guantanamo assessment documents, video from a controversial 2007 airstrike in Baghdad and military records of a 2009 U.S. airstrike in Gerani, Afghanistan, in which dozens of civilians were found dead.
As the evidentiary hearing for Manning entered its fourth day, the government had called 13 witnesses and was expected to ask eight more to testify before the defense presents its case. Expected to last several more days, the hearing will help determine whether Manning should be court-martialed on 22 charges, including aiding the enemy. If convicted at court-martial, Manning could face life in prison.
Manning, 24, of Crescent, Okla., is accused of giving the secrets-sharing website WikiLeaks a trove of government material while working as an intelligence analyst in Iraq in 2009 and 2010, including Iraq and Afghanistan war logs, and State Department cables.
On the stand Monday, digital-crimes investigator David Shaver said he recovered more than 100,000 State Department cables and other sensitive information on a secure computer that Manning used.
The cables were contained in a deleted .csv file, ordered by a message record number that indicated the embassy where they originated.
"It seemed like someone wanted to make sure they got all of them," said Shaver, who is special agent with the Computer Crime Investigative Unit of Army Criminal Investigation Command.
In open session, prosecutors and defense attorneys sparred over the potentially damaging evidence. Under cross examination, Shaver said to defense attorney Capt. Paul Bouchard that some of the cables did match those published by WikiLeaks. The damaged file could only be opened with special tools, which could explain why those documents weren't published.
Based on an examination of Manning's computer, Shaver said he recreated Manning's searches, which led to downloads of detainee assessments that have been published by WikiLeaks.
On Manning's personal laptop, a MacBook Pro, CCIU investigator Mark Johnson said he found chat logs between Manning and hacker Adrian Lamo.
On Sunday, Shaver said in court that "it stood out" that on one of Manning's laptops, Firefox's homepage was set to Intelink, considered the main search engine for the U.S. intelligence community's secure networks, and that it was set not to record its browsing history.
From the time Manning arrived in Iraq in October 2009 to May 2010 when he was arrested, Manning had conducted many intelligence searches using key words including "WikiLeaks," "Julian Assange" (WikiLeaks' founder), "Iceland" and "retention of interrogation videos," Shaver said. The last term corresponds with a solicitation from WikiLeaks.
Investigators concluded that hundreds of documents, image and video files that had been downloaded through Manning's computer profile that were connected to a controversial U.S. airstrike in May 2009 at Gerani village. Shaver said files included documents about burn victims and aerial reconnaissance video.
Shaver said he found two versions of a 2007 video, called "Collateral Murder" by WikiLeaks: The "released version from WikiLeaks and another version that seemed to the source for it." WikiLeaks used the gunsight video from Apache helicopters involved in a series of air-to-ground attacks in 2007 in which 11 people died, including two employees of the Reuters news service.
Defense attorneys have focused on supervisors' failure to pull Manning's security clearance in spite of his erratic and sometimes violent behavior, as well as broader security lapses in the facility on Forward Operating Base Hammer where Manning worked. Fifteen people, including the noncommissioned officer in charge of the facility, have been disciplined in the case.
Contributing: The Associated Press