Under the Radar Blog Archives Select Date… August, 2020 July, 2020 June, 2020 May, 2020 April, 2020 March, 2020 February, 2020 January, 2020 December, 2019 November, 2019 October, 2019 September, 2019

Patrick Semansky, File/AP Photo Defense lawyers for former NSA contractor want deeper look at what he allegedly stole

BALTIMORE — Defense lawyers for a former National Security Agency contractor accused of illegally storing a slew of classified information at his Maryland home squared off in court Tuesday with prosecutors about their refusal to give the defense copies of the computer hard drives and other electronic devices seized in an FBI raid more than two years ago.

Experts for both sides in the case against computer specialist Harold Martin Jr. acknowledged that the standard practice in criminal cases involving digital evidence is for the defense team to receive so-called mirror images of the devices and drives that could be at issue in a trial.

However, federal prosecutors have balked at doing so in Martin’s case, citing the volume of data and the sensitivity of the massive trove of documents Martin allegedly assembled while working at a series of federal agencies.

Instead, they’ve offered the defense an NSA-assembled “library” with data about the millions of electronic files found on particular devices at Martin’s home.

In truth, the library sounds more like a digital card catalog. If the defense wants to see the actual documents, they have to make an additional request, which may or may not be granted depending on the sensitivity of the underlying information.

POLITICO Playbook newsletter Sign up today to receive the #1-rated newsletter in politics Email Sign Up By signing up you agree to receive email newsletters or alerts from POLITICO. You can unsubscribe at any time. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Defense lawyers say the arrangement has undermined their ability to defend Martin. His defense team says the so-called library doesn’t contain the computer-based metadata that could reveal if Martin ever opened the files or when he did so.

“We need to be able to tell the jurors that Mr. Martin never opened one of those files sitting on those hard drives,” defense attorney Deborah Boardman said during a hearing that stretched to more than three hours Tuesday before U.S. District Court Judge Richard Bennett. “This library is insufficient. ... It is not a mirror image.”

Boardman colorfully compared the defense’s predicament as akin to trying to reconstitute a pig that’s been passed through a sausage grinder.

“We’ve been given the sausage and we want the slaughtered pig,” she said.

Prosecutor Harvey Eisenberg said the government doesn’t think whether Martin opened the files is relevant to his guilt. “This has nothing to do with whether he opened it, looked at it, or whatever. In fact, we don’t really care,” the prosecutor said.

Eisenberg said handling the evidence has been challenging for the government because of the sheer volume of information Martin allegedly stole.

“This is about an unprecedented situation created by the defendant’s alleged theft of a massive amount of classified information,” the prosecutor said. “We’ve done the best we can.”

Bennett heard live testimony from three experts Tuesday about the NSA-created library and whether it’s an adequate substitute for the usual practice of sharing “mirror images.”

“The only thing that’s the best evidence in the computer world is mirror images. Nothing else will suffice,” computer forensics specialist Larry Daniel said on behalf of the defense.

“This is an unorthodox approach, where you have decades of forensic practices that have not been applied here,” said Konstantinos Dimitrelos, a former Secret Service agent working for the defense.

While some reports put the amount of data seized from Martin’s home at as much as 50 terabytes, the figure widely used at Tuesday’s hearing was 22 terabytes, although that may not encompass everything found in his residence.

Daniels said that’s a lot of data, but not unmanageable as the prosecution has suggested. “Twenty-two terabytes is a bit to copy, but in today’s world you can go down to Best Buy and buy some 4 terabyte drives,” he said. “It’s not that big anymore.”

A top FBI expert on cyber evidence, David Loveall, said he’d examined the NSA library and found it to be well-suited to the task. “This seemed to be a pretty nice implementation in terms of scalability, from what I saw,” he said.

However, he conceded that the NSA system did not use independently tested software and did not ingest some data forensics experts often want to look at, like the deleted files and other information in so-called unallocated space.

Loveall did say that some of the information about who accessed the files might be contained in the NSA library, in files on so-called “virtual machines.”

Bennett did not immediately issue a formal ruling on the defense requests, but as the hearing concluded he appeared to be seeking a middle ground that would provide the defense with some of the details they said were critical to their case but not the full set of mirrored data they have been demanding.

Martin, 54, was present and attentive throughout the hearing, clad in old-fashioned, black-and-white prison stripes and sporting a gray beard and close-cropped hair. His lawyers consulted with him about some of the documents discussed during the court session. Two federal marshals kept watch over him, handcuffing him and leading him out during breaks.

Martin faces 20 counts of illegal retention of classified information. Each carries a potential maximum 10-year prison sentence, but under federal sentencing guidelines he’d likely get a sentence well short of the maximum. He offered to plead guilty to one count, but prosecutors declined to dismiss the other charges.

Last month, Bennett turned down a defense motion to toss out the evidence seized from Martin’s home, but agreed that the jury could not hear statements made to FBI agents on the day they raided the residence in 2016. The judge said the use of a SWAT team and other tactics may have given Martin the impression he was under arrest at the time, but agents did not read him his Miranda rights.

Martin is currently being held without bond. If his trial kicks off in June as presently scheduled, he’ll have served nearly three years behind bars before the trial opens.

