The thing with JSP is that is translated into servlet code with all the
literal output (carriage returns, spaces and all) turned into
out.println() code.

Once anything has been committed to the "out" (response objects)
OutputStream, you won't be able to "get" it like you have below.

It can be a tricky exercise to get around this. I'll post a short example
at the bottom.

<snip>

This fails if the OutputStream has already been "gotten". Like I mentioned
above.

We had to do the following sort of munging to ensure no leading whitespace
for one of our pages. Here's an example of what we did merged with some of
your code:

<%@ page import="java.io.*"
%><%@ page import="java.util.*"
%><%@ page import="java.text.*"
%><%--
These comments (and silly formatting above) remove newlines so that no
leading whitespace is printed
--%><jsp:useBean class="com.peregrine.oaa.archway.User" scope="session"
id="user"/><%--

--%><%
// Code to read file and output here... sAttachment = "attachment;
filename=\""+ sFileNameAtt +"\"";
response.setContentType("application/octet-stream");
response.setHeader("Content-Disposition", sAttachment);

InputStream is = null;
OutputStream out2 = null;
try
 {
 out2 = response.getOutputStream();
 is = new FileInputStream(request.getRealPath("files/" + sDirectory +
sFileName));
 int i;
 while ((i=is.read()) != -1)
   {
   out2.write(i);
   }
}catch (Exception e){}
...
%>

Hope that works for you.