Files disappear from the phone of the former Spanish soldier who spied on Julian Assange for the CIA

One of the main pieces of evidence against David Morales, the former Spanish soldier whose company spied on Julian Assange and his lawyers during his prolonged stay at the Ecuadorian Embassy in London, has disappeared. The Spanish police did not deliver to Judge Santiago Pedraz the complete file of the Samsung S7 phone used by Morales to communicate with the alleged CIA agents to whom he provided the WikiLeaks founders’ defense strategy, according to documents of the judicial investigation to which EL PAÍS has had access. After repeated judicial requests, officers responded that “they do not know” the location of the complete file. Judge Pedraz has ordered its immediate recovery.

Prosecutor Carlos Bautista has complained about the disappearance of this file, which he describes as “essential” to the case. He has demanded it be found “because it contains more data than that made available to the parties.” The Public Prosecutor’s Office said: “It is extremely striking that the police unit has delivered the UFDR (Universal Forensic Data Report) and UFDX (Universal Forensic Data Exchange) files from the other devices and has not done so precisely from this one.” Previously, the Prosecutor’s Office also complained about the “certain paralysis” caused by “the exasperating slowness of the police force involved in the analysis of all the elements seized.”

Judge Pedraz has summoned the officers of the Cybercrime Unit to appear in court and make a copy — in his presence — of both files on the Samsung S7 in an attempt to recover the omitted information and find out who is responsible for its disappearance. Spain’s National Police declined to respond to this newspaper’s questions.

Samsung S7, key evidence

During the search of Morales’ home and offices in the Spanish city of Jerez de la Frontera, in September 2019, the investigators’ primary objective was precisely to seize the Samsung S7 G930F phone that protected witnesses (company workers) had configured for Morales so that he could allegedly communicate with the CIA. This detail was communicated to the officers who detained Morales before the arrest took place. But the police handed over the complete files of all the phones, computers and electronic devices seized from Morales’ home and offices, except for the files on the Samsung phone. This police action has meant that the Userdata folder — which stored Morales’s conversations on WhatsApp, Signal, Telegram, Proton Mail and Skype — has been removed from the case.

Morales — the owner of UC Global SL, a company that was in charge of security at the Ecuadorian embassy in London — was arrested two months after an EL PAÍS investigation released the audios and videos that its workers recorded of the Australian activist inside the embassy. This material was presented as evidence in a criminal complaint filed by Assange’s defense team, and Spain’s High Court, the Audiencia Nacional, opened an investigation into the violation of attorney-client privilege, misappropriation of funds and money laundering.

The Samsung S7 was the only phone from which information was extracted in situ during the raids and searches of the police operation. This did not happen with any of the other phones and devices seized, according to the police response to the magistrate, who waited months to receive an explanation from the officers. The police response sent to the Court of Instruction No. 5 of the Audiencia Nacional, which is in charge of the case, contrasts with the testimony of the lawyer of the justice administration, who recorded the seizure of all phones.

The consequence of this anomaly is that the file uploaded by the police unit to the cloud — where evidence is downloaded and accessed by the parties involved in the case — is not the original and complete UFDX file, but only the UFDR file, which is derived from the previous one but does not represent the complete copy of the device. The UFDR file provided by the agents is missing the Userdata folder, which stored the data of the messaging applications. Furthermore, Assange’s defense team points out that the UFDR file uploaded to the cloud does not come from the UFED Touch dump machine, as is the case with all the other phones in the investigation, but from a personal computer that was seized.

Agent ‘Paisa’

The Samsung S7 phone had an alternative external keyboard called Swiftkey that records the words that are typed on that device and thanks to that feature, experts have been able to partially rescue some conversations in English about the embassy, Assange, the CIA and the agent “Paisa,” a Morales collaborator in the United States allegedly linked to the CIA. But these conversations do not appear recorded anywhere other than the keyboard, since the Userdata folder that stored the missing conversations from messaging apps was deleted.

Spain’s General Commissariat of Judicial Police told Judge Pedraz in a police document that on February 7, “all copies of the devices were delivered, with none remaining in this section. Thus, it is not known where these files could be found nor where they could be located within the devices delivered.” The magistrate has ordered the Technical Group of the Cybercrime Unit, which uploaded the data, to examine the hard drives delivered by the investigators and extract a copy of the UFDX and UFDR files from Morales’ Samsung S7.

This is the second time that it has been discovered that police have omitted relevant information contained in the electronic devices seized from the owner of UC Global, SL. Last year, Assange’s team were authorized to make a second copy of the material seized by the agents. The new document dump revealed more than 213.1 gigabytes, 551,616 files and 973 email files that had been omitted by the police.

Among the new files, a folder titled “Operations & Projects” was saved, containing directories organized according to geographical area. Each region or country is specified, along with the details of the services to be provided. In the area corresponding to North America — within the “USA” directory — there is a file called “CIA.” Inside — in a folder marked “Videos” — images of recordings are stored. These were obtained via the hidden cameras and microphones that UC Global installed in the Embassy of Ecuador in London to surveil the meetings of the WikiLeaks founder.

Investigacion@elpais.es

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition