Police omitted folder called ‘CIA’ from the computer of Spaniard who allegedly spied on Julian Assange

David Morales — the owner of the Spanish security company that spied on Julian Assange during his prolonged stay at the Ecuadorian Embassy in London — kept the work he did for the CIA on his laptop. It was all marked under the initials of the U.S. intelligence agency, according to a new examination of his MacBook, to which EL PAÍS has had access. The word “CIA” appears several times on a Western Digital-branded external hard drive, on which Morales kept the projects and operations that his company — UC Global, S.L. — was contracted to deliver.

Morales’ personal files, which were previously unknown to investigators, builds on the allegations and evidence that Morales — a former Spanish soldier — spied on the meetings that the WikiLeaks founder and his lawyers held at the Embassy of Ecuador to the United Kingdom, and sent that information to the U.S. intelligence agency. These files were stored on a number of folders marked with the terms “CIA,” “Embassy” and “Videos,” along with other labels.

The appearance of this new evidence has been a surprise in the case against Morales in Spain’s High Court, the Audiencia Nacional. None of these computer records previously appeared in the initial copy made by the police, when officers categorized the material seized from the security contractor when he was arrested in September 2019. All of this material was uploaded to a cloud storage system within the judicial systems, so that all parties involved in the case could review it. The arrest and indictment of Morales took place weeks after an investigation by EL PAÍS revealed the videos and audios that UC Global employees had recorded while the Australian was preparing his defense with his lawyers.

The discovery of these new clues about the CIA’s spying on the cyberactivist — who remains imprisoned in a London jail — is no accident. Assange’s lawyers found problems when downloading the records uploaded to the cloud. They managed to get Judge Santiago Pedraz — who is overseeing the case — to authorize a second copy of the material seized by the agents. A new digital document dump offered a clear picture that the police had not pieced together. Now, a report by the experts called by Assange’s lawyers credits the appearance of “a very relevant volume of material, which was not included in the original [police] copy.” Forensic analysis describes the copy of the hard drive as containing “multiple pieces of evidence.” In this second dump, the mentioned folders have appeared, including the one that UC Global labelled as “CIA.”

Hidden microphones

The difference in the size or volume of the two copies is substantial. The document dump from Morales’ computers, flash drives and electronic devices provided by police was 213.1 GB less than the one recently obtained by Assange’s defense — an equivalent of 551.616 files and 973 email files. Among the new files, a folder titled “Operations & Projects” was saved, containing directories organized according to geographical area. Each region or country is specified, along with the details of the services to be provided.

In the area corresponding to North America — within the “USA” directory — there is a file called “CIA.” Inside — in a folder marked “Videos” — images of recordings are stored. These were obtained via the hidden cameras and microphones that UC Global installed in the Embassy of Ecuador in London to surveil the WikiLeaks founder. Each recording is dated and titled. Some examples are “Pamela Anderson” — which contains the meetings with the actress, a friend of Assange — “Guest,” being the name that Morales’ employees used to refer to the Australian; “Ladies toilet,” a place where Assange held meetings with his lawyers for fear of being spied on; and “Fidel,” the Ecuadorian consul who tried to get Assange out of the U.K. with a diplomatic passport.

The video files were transferred to a commercial format and renamed with references to their contents, in order to make them visible and accessible to the final user. In this case — and according to what appears on Morales’ own computer — said user, or client, was the CIA. The new evidence seized from the ex-soldier coincides with the material delivered to the judge by a former UC Global worker, who has been granted the status of protected witness.

Until now, the suspicions that the owner of UC Global sent the material obtained during the espionage operation at the Ecuadorian Embassy to the CIA was based on the evidence provided by EL PAÍS, as well as on statements made by several former employees of the security company. Also, there were emails from Morales, in which he claimed to be working for “the American client” and that he had “gone over to the dark side” by collaborating with “American intelligence.” To his trusted employees, he once wrote that “those in control are the friends of the USA.”

The data provided by Morales to the CIA resulted in the plan to remove Assange from the embassy (during Christmas of 2017) to be aborted, as revealed by EL PAÍS. The United States has requested Assange’s extradition, and the United Kingdom has granted it. But the case is still pending, as there are several judicial appeals that can be made.

“Very relevant” folders that were not copied

The report by Assange’s experts — Manuel Huerta and José Manuel Martínez — highlights that “very relevant” folders for the investigation, such as those from Morales’ desktop, were not copied in the police dump. The expert analysis highlights the appearance of “deleted folders with information,” among which are several marked with the word “hotel” — the name Morales used to refer to the Embassy of Ecuador in London, where Assange took refuge and where he was spied on. “There’s an abysmal loss of files and folders,” the experts conclude.

Aitor Martínez — Assange’s lawyer — highlighted in a letter addressed to the judge that there is an “enormous disparity” between the evidence that appears in the original copy made by the police and the document dump that the cyberactivist’s experts have just obtained from the same source. “To this is the added inactivity of the police unit, which, until now, hasn’t submitted any official letter or report about the initial copies, which, as we now know, were biased and did not reflect the reality of the material of interest to this case,” the lawyer notes. He has requested a six-month extension to the investigation into Morales. Following these criticisms, the police officials have submitted a report to the judge, in which they attempt to establish all the commonalities between the digital material delivered by a protected witness and what was found on the computer.

Former marine David Morales is on provisional release. He is being investigated for crimes against privacy, violation of the confidentiality of attorney-client communications, misappropriation and money-laundering.

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition