The Insider Threat: PVT Bradley Manning 14 April 2014 (blmtE) 1 one LU) Agenda (U) Insider Threat Motives (U) PVT Manning?s Motives (U) Behavioral Indicators of Insider Threat (U) PVT Manning?s Behavior Indicators (U) PVT Manning Timeline (U) How PVT Manning Disclosed information (U) Summary and Discussion Outcome (U) On 27 May 2010 PFC Bradley Manning was arrested for leaking classi?ed material to the online leakers website ?Wikileaks?. He was charged with 22 criminal charges; including espionage and aiding the enemy. (U) On 21 August 2013, PVT Bradley Manning was found guilty of 20 of the 22 charges and was entenced to 35 years in prison. . . UNCLASSIFIED . (U) lnsider Threat Motives (U) Motives Greed or ?nancial dif?culties Disgruntled or wants revenge Ideology Divided loyalties Vulnerable to blackmail - Ego/Self?lmage lngratiation Family/personal issues UNCLASSIFIED (U) Insider-Threat Motives (U) PVT Manning?s Motives Greed or financial dif?culties Disgruntled or wants revenge Ideology Divided loyalties Vulnerable to blackmail I?n Ego/Self-image lngratiation Family/personal issues a- 5 (U) Insider-Threat Motives (U) PVT Manning?s Motives Disgruntled - PVT Manning was very disgruntled during his deployment in Iraq. A signi?cant attributer to his disgruntlement was his social and physical identity which he felt was suppressed by the US Anny and it?s atmosphere toward homosexuality. (U) PVT Manning?s Motives Ideology - PVT Manning was associated to a group of self-proclaimed ?hackers? who deemed all information (government in particular) should be public knowledge. He was accepted in this group and associated himself as a ?hacker? and subscribed to the group?s ideology. UNCLASSIFIED (U) Insider?Threat Motives (U) PVT Manning?s Motives Ego and lngratiation - PVT Manning identified himself as an advocate of government information should all be publically available. He had the access and capability to provide Julian Assange, a world-wide recognized foreign national who was, at that time, on the forefront of the ideology which matched PVT Manning. PVT Manning, although regretting his actions now, saw himself as a hero to the public and to the families of the Reuters reporters killed by the Apache helicopter; which became known as Collateral Murder. (U) PVT Manning?s Motives Family/Personnel Issues - Before PVT Manning became a US Army Soldier, he was shunned by his father who didn?t accept his son's outlook on life. Bradley Manning did not hold jobs for long and was homeless for a short period of time before moving to Maryland to live with his aunt. During PVT Manning's service in the US Army, he struggled with his self image as a man, when he wanted to be an openly accepted female in the US Army. PVT Manning was also an advocate for homosexuals openly serving in the vs. the DADT policy. LU) Behavior Indicators of lnsider Threat (U) Behavior Indicators Interest in matters outside their scope of responsibilities. lnappropriately seeks to obtain classified information on subjects not related to their work. Downloadsfl'ransfers information without prOper authorization or need via media devices or email. Deliberate and unnecessarily copies of documents or media. Works unusual times outside normal duty hours. Unexplained af?uences. Engaged in suspicious personal contacts. Unreported foreign contacts. Overwhelmed by life crises and/or career disappointments. Compulsive and destructive behavior UNCLASSIFIED (U) Behavior Indicators of Insider Threat (U) PVT Manning?s Behavior Indicators Interest in matters outside their scope of responsibilities. Inappropriater seeks to obtain classi?ed information on subjects not related to their work. Downloadsfl'ransfers information without proper authorization or need via media devices or email. Deliberate and unnecessarily copies of documents or media. Works unusual times outside normal duty hours. Unexplained af?uences. Engaged in suspicious personal contacts. Unreported foreign contacts. Overwhelmed by life crises and/or career disappointments. Compulsive and destructive behavior 10 UNCLASSIFIED Behavior Indicators of Insider Threat (U) PVT Manning's Behavior Indicators Interest in matters outside their scope of responsibilities. - PVT Manning would often disregard his responsibilities, assigned to him as an US Army Intelligence Analyst in Iraq. Besides his illegal transfer of classi?ed information he also obsessively researched websites regarding DADT and politicians who supported or didn't support the lesbian/gay community. He conducted this activity while being assigned to research and analyze the patterns and threats of IED attacks. InapprOpriater seeks to obtain classi?ed information on subjects not related to their work. PVT Manning utilized his access to classi?ed database systems to search, collect, summarize and disseminate Department of State information, GITMO detainee biographies and accessed US Army Judge Advocate digital records. 11 (U) Behavior Indicators of Insider Threat (U) PVT Manning?s Behavior ln'dicators Downloadsz ransfers information without proper authorization or need via media devices or email. PVT Manning had the capability to transfer data from his to his and personal computers. Deliberate and unnecessarily copies of documents or media. PVT Manning c0pied and retained classi?ed information on his NIPR and personal computers. Works unusual times outside normal duty hours. PVT Manning utilized his 12 hour shift from late evening (~7pm) until the morning (~7am) to conduct his illegal activity. Engaged in suspicious personal contacts or foreign contacts. PVT Manning contacted Julian Assange using methods and chat rooms. 12 (U) Behavior Indicators of Insider Threat (U) PVT Manning's Behavior Indicators Overwhelmed by life crises and/or career disappointments. PVT Manning had a relationship with a boyfriend who disassociated himself from PVT Manning during his deployment. Additionally, PVT Manning struggled with his self-image as a man. when he wanted to be an openly accepted female in the US Army. Compulsive and destructive behavior PVT Manning before his deployment to Iraq had uncontrolled verbal outbursts directed at his Platoon Sergeant. While deployed in Iraq. PVT Manning had a physical altercation with another Soldier, was absent from his office to and later found curled up in a conference room with the words, "i cut into a conference chair and ultimately had his bolt from his ri?e removed. Manning was sent to work in the supply room after this, but his clearance and access remained intact. 13 (U) PVT ManningTimeline . 14 (U) PVT Manning Timeline In October 2009, deployed to Iraq, His focus was threats to the FOB Hammer, Iraq area - 17 Nov 09, Manning is given SIPRNET access (lntelink) - 28 Nov 09, Manning searched lntelink for and ?interrogations? - 01 Dec 09 - May 10, Manning searched lntelink for ?Wikileaks?, 119 times. LU) PVT Manning Timeline - 29 Nov 09, Manning searched lntelink for and (Manning found the server hosting, the Gharani/Farah Air Strike) - 01 Dec 09, Manning viewed the Army Counterinteiligence Center report on Wikileaks. -Released by Wikileaks - 08 Dec 09, Manning searched lntelink for ?Guantanamo detainee operations" and SOPs. -Released by Wikileaks 16 (U) PVT Manning Timeline - 05 Jan 10, Manning created a single .CSV file containing the database (~380,000 reports) Released by Wikileaks - 08 Jan 10, Manning created a single .CSV file containing the database (~91 ,000 reports) Released by Wikileaks - - 23 Jan 10, Manning arrives at his Aunt?s residence in MD on his mid-tour leave - 25 Jan 10, Manning takes a trip up to Boston. - Wants to see some friend l'i? w) PVT Manning Timeline - 30 Jan 10, Manning created an ?le on 3 SD card (which had been used by his personal camera) containing the two CSV ?les and a ?read me? ?le. i READ ME - it?s'alreadybeen sanitized of any source identifying information. You might need to sitonithis information, perhaps 90-180 days, to figure out how best If-to releasesucha large amount of data, and to" protect source. This is possibly one of the more significant documents of our time, removing the fog of war; . a n?d reveaiing the true nature of let century asymmetric warfare. fill-'iave'a'good: day? This SD card was left at hisAunt's residence in MD. 18 (U) PVT Manning Timeline - 01 Feb 10, Manning returned from Boston to Aunt?s residence in MD - 11 Feb 10, Manning returns to lraq. - 14 Feb 10, Manning downloaded various secret documents pertaining to Wikileaks from SIPRNET and burns them to CD. - Later released by Wikileaks - 20 Feb 10, Manning gets a SIPRNET, Open Source Center Account. ?Searched for Wikileaks ?Searched for Iceland - Mar - Apr 10, downloaded 254,287 Department of State cables - Later released by Wikileaks - 19 (U) PVT Manning Timeline 05 Mar 10. Manning tells Julian Assange, via chat, he had nothing left to give him. - Julian tells him to keep looking. 05 Mar 10, Manning started to manually download all the GTMO Detainee files from the SIPRNET. - 07 Mar 10, Manning used wget to download 700+ Detainee files from the SIPRNET. Released by Wikileaks - 07 Mar 10, Manning tells Julian Assange, via chat, he has the Detainee ?les and then he uploads them to Wikileaks. - 21 Mar 10, Manning downloaded ?les to his work computer, burned them to a CD and viewed the zip ?le on his personal Macintosh laptop. - Released by Wikileaks 20 (U) Wget.exe Wget is a free utility designed for non-interactive download of files. it works like a web-crawler extracting resources from linked HTML pages and downloading them in sequence and repeating the process based on the parameters set by the user. 21 UNCLASSIFIED LU) Wgetexe Wget can follow links to create local versions of remote web sites, fully recreating the directory structure of the original site. - Wget can be instructed to convert the links in downloaded files to point at the local ?les, for of?ine viewing. Wget supports va6 and va4 Wget has been designed for robustness over slow or unstable network connections. - Capable of being configured to pull specific information or to randomly pull an entire website. Ultimate tool for gathering and compiling Intelligence. 22 Freedom of Information Act/Privacy Act Deleted Page(s) Information Sheet Indicated below are one or more statements which provide a brief rationale for the deletion of this page. Information has been withheld in its entirety in accordance with the following exemption(s): It is not reasonable to segregate meaningful portions of the record for release. 11 Information pertains solely to another individual with no reference to you and/or the subject of your request. Information originated with another government agency. It has been referred to them for review and direct response to you. El Information originated with one or more government agencies. We are coordinating to determine the releaSability of the information under their purview. Upon completion of our coordination, we will advise you of their decision. Other: DELETED NO DUPLICATION FEE FOR THIS PAGE. Page(s) 23-24 IAGPA-CSF Form 6-R 1 Sep 93 (U) PVT Manning Timeline - 10 Apr 10, Manning downloaded the entire Gharani/Farah air strike investigation (minus the videos). The files are then zipped up on his work computer and then burned the zip file to a CD. The CD was then loaded onto his personal Macintosh computer and then provided to Wikileaks, which Manning with 25 (U) MannincLTime Line - 08 May 10, Manning assaulted his team leader (punched her in the face). Manning was then removed from and placed into the Supply Room. - 09 -24 May 10, Manning used other SIPRNET computers to cdntinue to search for Wikileaks. 13 May 10, Manning downloaded the NIPRNET GAL. then emailed it to his gmail account. -Released by Wikileaks 21-24 May 10, Manning chats with Mr. Adrian Lamo, informs him about disclosing all the material. Mr. Lamo then reports this to the authorities. 26 (U) Manning Time Line - 27 May 10, Manning is arrested in Iraq - 27 May 10, Manning is allowed to talk to a co-worker. He convinces her to log onto his Facebook account and post an entry on his wall taking credit for releasing the Collateral Murder video. 27 UNCLASSIFIED 7- - (U) How PVT Manning Disclosed information - PVT Manning had unsupervised access to information retained on local hard drives and websites. He obtained and installed the unauthorized program, ?Wget.exe? to his SIPR computer which enhanced his capability to acquire vast amount of data from the US?State Department. - He contacted Julian Assange, via chat rooms, for instructions and advice on how to give Julian Assange all of the information. In a sense, Manning was acting like a tasked asset. Extracted and provided Julian Assange with the personal information and email addresses of over 74,000 service members serving in Iraq after being removed from the 28 LU) How PVT Manning Disclosed Information PVT Manning researched and obtained sensitive videos and classified documents which resided on unsecured shared folders (including JAG folders). Manning utilized a Wget program and the capability to download the data to CDs from his computer, then transfer data from CDs to mostly to his personal computer. He sent the classified data, via his personal computer, to Wikileaks and also stored the Iraq and Afghanistan war logs onto his cameras media card. 29 UNCLASSIFIED (U) Summary - PVT Manning deliberately compromised US sensitive information based on an ideology that information retained by the US Government should be in the public domain. -PVT Manning's ideology may have developed from his interactions with self-proclaimed "hacker" groups, in the Fall of 2008., which believed information should be unrestricted. Manning was able to surreptitiously act on his ideology because his work environment lacked strong enforcement and oversight of sound SCIF procedures. - WikiLeaks, through Julian Assange, provided an opportune capability for PVT Manning to disseminate sensitive US Government information. - Due to the actions of PVT Manning, in deployed environments have become stricter (no USB drives, CD burning capabilities restricted/ managed, token cards, -Further promoted the ideology that all information should be public. Despite these restrictions an individual can still compromise US Sensitive and Classified Intelligence 30 Freedom of Information Act/Privacy Act Deleted Page(s) Information Sheet Indicated below are one or more statements which provide a brief rationale for the deletion of this page. Information has been withheld in its entirety in accordance with the following exemption(s): and It is not reasonable to segregate meaningful portions of the record for release. Information pertains solely to another individual with no reference to you and/or the subject of your request. I:l Information originated with another government agency. It has been referred to them for review and direct response to you. El Information originated with one or more government agencies. We are coordinating to determine the releasability of the information under their purview. Upon completion of our coordination, we will advise you of their decision. Other: DELETED NO DUPLICATION FEE FOR THIS PAGE. Page(s) 31 01111 1 Sep 93