Key evidence deleted in case against ex-military man who spied on Julian Assange for CIA, says expert report

The IOmega hard drive used by Spanish police to store information obtained from the phones and computers of David Morales, a former military officer investigated for spying on Julian Assange for the CIA, was tampered with while it was inside a sealed cabinet in the custody of Spain’s High Court (Audiencia Nacional), according to an expert report by the Australian cyberactivist’s defense team.

The manipulation allegedly deleted 17,256 emails from various accounts, including some of the suspect’s. This access to the hard drive in the custody of the Investigative Court No. 5 of the Audiencia Nacional, which is investigating Morales for various crimes, allegedly occurred on September 9, 2020.

The WikiLeaks founder’s experts claim they have found “modifications and alterations” to this disk after September 17, 2019, the date Morales was arrested at the headquarters of his company, UC Global, SL, in Jerez de la Frontera in southern Spain. The arrest and search occurred weeks after an investigation by this newspaper published audio and video recordings of the spying on Assange and his lawyers, ordered by Morales, during the activist’s stay at the Ecuadorian Embassy in London.

The expert report, to which EL PAÍS has had access, states that the deletion is not the result of any automated software process, “but rather an action carried out by someone within the police unit” that was involved in the search and dumping of the devices. “It can be said that the police unit involved may have been interested in concealing information,” maintain the experts Manuel Huerta and José Manuel Martínez. The police have declined to respond to this newspaper’s questions.

Sealed in a cabinet

The alleged tampering with this disk, which had been stored and guarded for more than five years inside a courtroom cabinet, was discovered after the WikiLeaks founder’s lawyers confirmed that the police had only provided the judge with a partial dump of the contents of Morales’ Samsung S7 G930F phone. This device was key to the investigation because protected witnesses in the legal case against the owner of UC Global, SL confessed that they had configured the device to allegedly communicate with the CIA. The Spanish police officers were informed of this before they arrested Morales.

The police handed the judge complete dumps of all the phones, computers, and electronic devices that were seized, except for the aforementioned Samsung. This led to the deletion of the Userdata folder, which contained conversations held by Morales on WhatsApp, Signal, Telegram, Proton Mail and Skype. This lost material was a treasure trove of information about this former collaborator of Spain’s National Intelligence Center (CNI).

The Samsung S7 was also the only phone from which information was extracted on-site during the police searches, a practice that was not carried out on any of the other phones and devices seized, according to the police’s response to the judge’s questions. A different device was used for the data extraction, which, according to Assange’s experts, was registered as a Desktop BOIQ F96. The rest of the material from the other devices was obtained using the tool UFED Touch.

Thus, the file uploaded by the police unit to the judicial cloud ―where all the evidence obtained is downloaded and which is accessed by the parties involved in the case― is not the original and complete UFDX file (Universal Forensic Data Exchange) of the Samsung S7, but only the UFDR file (Universal Forensic Data Report), which is derived from the previous one, but which does not represent the complete copy of the device.

Police paralysis

Carlos Bautista, the lead prosecutor in the case, did not hide his displeasure over the disappearance of this file in his briefs. He described it as “essential” and, like the plaintiffs, requested that it be located “as it contains more information than the information made available to the parties.” “It is extremely striking that the police unit has handed over UFDR and UFDX files from the other devices, but has not done so specifically from this one,” the prosecutor criticized. He also accused the officers of dragging their feet in their cooperation with the court due to their “exasperating slowness” in analyzing all the seized items.

In September, Judge Santiago Pedraz summoned agents from the Cybercrime Unit to appear in court and dump the contents of the IOmega drive they handed over after the arrest. This device, held in judicial custody since 2019, is where the information from the Samsung S7 phone was allegedly stored. The goal was to recover the full image (UFDX), but no trace of the missing file was found.

Assange’s representatives believe that on the day Morales was arrested, agents used, in addition to the IOmega, another hard drive or parallel electronic device to download information from the Samsung S7, the key phone in the investigation. This other drive was subsequently removed from the judicial investigation, they believe.

Pedraz and Pedro Martínez, the new prosecutor in the case, have rejected the plaintiffs’ request to open a separate case and take statements from the nine police officers who participated in the operation, as well as to inform the General Directorate of Police, because the manipulation of computer evidence is not within the jurisdiction of the National Court. Both have responded to Assange’s request that he may file a complaint against the police with the competent body.

Other omissions

This is not the first time that the plaintiffs have alleged that the Spanish police have omitted relevant information contained in the electronic devices seized from the owner of UC Global, SL. A new dump of the former marine’s laptop revealed more than 213.1 gigabytes, 551,616 files, and 973 email archives that were hidden from the investigative judge. This is the difference between the two copies, the one dumped by the police and the one obtained by Assange’s defense team.

Among the new files, Morales had a folder called “Operations & Projects,” with directories sorted by geographic area and the services to be developed. In the North American section, within the USA directory, there is a folder called “CIA” and another one named “Videos,” where the recordings of the WikiLeaks founder’s meetings recorded by UC Global, SL’s hidden cameras and microphones were archived.

Since his arrest in 2019, Morales has been released pending trial and is being investigated by the Audiencia Nacional for alleged crimes against privacy, violation of attorney-client privilege, misappropriation, bribery and money laundering.

Following his expulsion from the Ecuadorian embassy and imprisonment, Assange, 52, was released on June 25 of this year after reaching a deal with the United States Department of Justice in which he pleaded guilty to a violation of the Espionage Act and accepted a five-year prison sentence that he had already served in London’s Belmarsh prison.

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition