Gary Shapley and Hunter Biden’s Colleague Named “Z”

There was a detail in Abbe Lowell’s letter to House Ways and Means Chair Jason Smith complaining about the way Smith platformed purported whistleblowers to launch an attack on Joe Biden that deserves more attention: Lowell claimed that Gary Shapley misrepresented the identity of the person with whom Hunter Biden had a WhatsApp exchange in 2017.

This is the WhatsApp exchange that Smith mocked up to look like texts themselves. The mocked up texts went wildly viral based on Smith’s unsubstantiated claim that Joe Biden was in the room with Hunter during his deal-making.

Lowell described that fake mock-up this way.

The agent only described one message, but you took that purported text and disseminated images of it on June 22 and June 24 in two Twitter postings.

The screen-grab images you posted are not real and contain myriad of issues: both include a photo of Mr. Biden not from 2017 but from the White House Easter Eggroll in April 2022 (long after the purported message was sent); both images portray the message in a blue bubble, when WhatsApp messages are in green; one image super-imposed the Chinese flag for the contact ID, when surely that was not how a text or contact was kept; and one purports to be a screenshot with the “. . .” of someone composing a text (as in Apple’s iMessage) when that does not happen on WhatsApp.

I explained why Smith had to attempt to recreate WhatsApp messages in this post: Shapley himself shared summaries of the purported WhatsApp messages, rather than the WhatsApp messages themselves or the forensic report from Apple whence (Shapley claimed) the IRS obtained them.

Not only did Shapley admit to the Committee they were summaries, but Shapley isn’t even sure who did the summary.

Q Could you tell us about this document, what is it, and how was it obtained —

A Sure. So there was an electronic search warrant for iCloud backup, and these messages were in that backup and provided —

Q Okay.

A — from a third party, from iCloud.

Q Okay. Who was it provided to?

A The — the investigative team from —

Q Okay. A It would go through all the same processes of — since it’s electronic, it would go to one of the computer analysis folks, and then they would put it in a readable format, and then it would go through filter review.

Q Okay. And these aren’t WhatsApp messages, these are summaries of WhatsApp messages, correct?

A Yeah, that’s correct. Because it was something about the readability of the actual piece, right? It was easier to summarize in a spreadsheet.

Q Okay. And who did the summary? Who prepared this document?

A It was either the computer analysis guy or [redacted, probably Whistleblower X], one or the other [my emphasis]

Even on their face, they’re not reliable summaries. In this text, for example, someone interjects their opinion, “believed to be Zhao” right into the middle of a purported quotation, without marking that opinion as such.

Given that the summary presents at least this direct quote with additional information, we can’t be sure whether other quotes — particularly references to Zhao — are accurate.

Compare Shapley’s summaries with what reliable law enforcement summaries of WhatsApp chats saved to iCloud and obtained from Apple look like (this was an exhibit in the Vladimir Klyushin trial and would have been obtained in the same timeframe).

Not only does this directly quote all the messages, but it includes exact time and the accounts used, details that should drive any law enforcement investigation.

The summary matters, a lot. That’s because Lowell claims that Shapley — or whoever did these summaries — misidentified the Hunter Biden interlocutor whose last name begins with Z.

In one excerpt that has now gotten a great deal of media attention, Mr. Biden is alleged to have been sitting next to his father on July 30, 2017, when he allegedly sent a WhatsApp message, urging the completion of some business transaction. See Shapley Tr. at 14. The inference is that the referenced message was being sent to an official of CEFC (China Energy) to forward a false narrative about the Bidens’ involvement in that company. The facts, which some media has now reported, are that President Biden and our client were not together that day, the company being referenced was not CEFC but Harvest Financial Group (with a person who also had the initial “Z”), and that no transaction actually occurred. More important, your own actions call into question the authenticity of that communication and your subsequent use of it. In short, the images you circulated online are complete fakes. Many media articles confirm that data purported to have come from Mr. Biden’s devices has been altered or manipulated. You, or someone else, did that again. All of the misstatements about this communication and your use of a false text are good examples of how providing one-sided, untested, and slanted information leads to improper conclusions. [my emphasis]

This is a remarkable claim, because — if true — it suggests the IRS was investigating Hunter Biden based on wildly incorrect assumptions about the identity of his interlocutors.

Abbe Lowell claims that the IRS agents who investigated his client for five years — the son of the President!!! — didn’t know to whom he was talking! I’ve heard a lot of outlandish claims from defense attorneys (though Lowell is far more credible than the grifters who defend a lot of January 6 defendants), But this is an utterly inflammatory claim.

Had Shapley used responsible summaries, rather than the unprofessional script he did use, it might be possible to figure out who is right, here, because then we could compare the actual number or email account used.

Or maybe not.

There’s another possible way to explain why IRS agents wouldn’t even know the identity of the person with whom Hunter Biden was discussing business deals.

One of the things that happened during January 2019 when Hunter Biden’s droidhunter88 account had taken over his iCloud account is that his contacts list was “restored.”

In the publicly released emails, there’s no indication of when the request was made, or restored from what. But it happened around the same time as “Hunter Biden” requested a full iCloud download, including his contacts list.

That iCloud download is almost certainly what became much of the content on what is now known as the “Hunter Biden” “laptop” — a laptop the IRS was using (after booting it up in a new laptop, if you can believe Shapley’s notes) for evidence in this investigation.

There are at least three possibilities here:

  • Shapley is right and Abbe Lowell is wrong
  • Whoever wrote these unprofessional summaries just guessed — wrongly — who Hunter’s interlocutor was
  • The iCloud contacts list that the IRS was using when these summaries were made had been altered

We don’t have enough data to know. But given what even Hunter Biden’s persecutors have released, we can’t rule out the last one — that the IRS was using a doctored contacts list to investigate Joe Biden’s son.

16 replies
  1. Shadowalker says:

    A fourth possibility is someone in the investigation was intentionally manipulating the evidence to reflect a specific narrative for political reasons. Though I think Lowell (almost positive) has the evidence to back up his claims since he most likely has input of all parties involved and not just Hunter.

    • Joeff53 says:

      You don’t say! Not the first time feds have “found” putatively incriminating data on a laptop belonging to a politically toxic person, after acquiring it under a highly suspicious pretext.

  2. Ravenclaw says:

    If Harvest Financial Group has/had an employee (of the sort who would be consulting with a client) with the initial “Z,” Mr. Lowell’s case would seem strong. Especially if that person remembered consulting with Biden junior. (I had a quick look but could only find partial employee lists, not a full directory. Also, there seem to be several organizations with the same name: one in Braintree, one in Pittsburgh, one in Kansas, one with offices in California and New York, and one in Australia. Maybe a couple of these are branch offices? But probably not all.)

  3. P J Evans says:

    As Shapley is, at the least, an unreliable witness, I’d think that the first possibility is right out, and that the third one is not at all unlikely.

    • John Paul Jones says:

      The real problem is that on the basis of publicly available information we can’t rule out #2: confirmation bias.

      That is, whoever wrote the summaries needed “Z” to be the person who fit the narrative of Biden, pere et fil, corruption. The parenthetical reference thus functions (for believers like Shapley) in narrative terms as additional “proof.”

      • jdmckay8 says:

        The real problem is that on the basis of publicly available information we can’t rule out #2: confirmation bias.

        Can’t rule out (any of them)… yet. Hold onto your hats!!!

  4. John Panzer says:

    Is it common for WhatsApp messages to be retained on personal devices for this many years? If so, possibly the person on the other end of this conversation has their copy. Which would be pretty definitive.

    On CNN this weekend, Riggleman implied they had proof of modified data, too. One way to get that proof would be the other side of some of these convos. (Modified content, not just the window dressing fake WhatsApp screenshot.)

    • emptywheel says:

      Therein lies the curiosity, one I hope to address in a post soon.

      Because the record suggests it shouldn’t have been on any device.

      • jdmckay8 says:

        Because the record suggests it shouldn’t have been on any device.

        This I don’t understand. Can someone clarify (eg. “the record suggests”)?

    • bmaz says:

      Lol, exactly how many more hours of law enforcement time, how many more resources, including money, not to mention prosecutorial time and resources and that of courts, do you think should be expended on this right wing ginned nonsensical garbage? The whole episode borders on insanity.

      • Marinela says:

        Except if this was doctored, somehow somebody needs to figure out what happened. This would be serious overreach from a government servant.

        I get what you mean by the episode insanity. Unclear what the solution is when we spend so much of the tax payers money on debunking RW conspiracy theories. Like Durham, he had no problem spending tax payers money chasing insane conspiracy theories.

        There is no shortage of prosecutors, IRS whistleblowers, FBI agents willing to advance RW conspiracy theories. It worked in 2016, didn’t work since, but it will probably work in the future again. Not as convinced the institutions can hold up for too much longer.

      • Shadowalker says:

        I’m wondering where the IG’s (both DoJ and IRS) are in this. Since it’s part of the job description.

      • Joeff53 says:

        When you have no fewer than 3 House chairmen goosing it along it’s hard to put the brakes on. Endless Benghazi hearings worked. “Tarmacgate” worked. They’re not gonna stop.

  5. jdmckay8 says:

    But it happened around the same time as “Hunter Biden” requested a full iCloud download, including his contacts list.

    Ahhh… really, REALLY good catch!!!

    Following your links to DOUBLE BOOKED: WHISTLEBLOWER X DESCRIBED INAPPROPRIATE PRESIDENTIAL INTERFERENCE … BACK IN 2019, there is something else that bothers me.

    If the FBI did that after that meeting, Shapley chose not to disclose the outcome. Given what we know about Mac Isaac’s treatment of the laptop, such a step might have showed whether the blind computer repairman’s failure to airgap the machine resulted in email updates — including from the recently hacked Burisma — being loaded to the laptop.

    I thought that computer was unbootable. What is there to airgap? And taking it one step further, if a copy was made to another HD, and used by FBI cyber ninjas (couldn’t resist), I do not think they could boot their brand new MAC with that HD. I never opened up a MAC. A commenter here in last few days explained this, adding (I don’t know specifics of doing this) that if the booting media (HD) was not matched to booting machine’s hardware they can update the OS in the process so it does boot.

    I can’t imagine how this would not generate the “A new device has accessed (new Mac etc. etc)” message to the other devices. There’s no record of that, correct? It makes me wonder if, at some point after Isaac got that machine, that it wasn’t quite as broken as he said.

  6. timbozone says:

    Thanks for continuing to fight the good fight against the confirmation bias that seems to have permeated the minds of so many people in the United States these past few years.

Comments are closed.