Hunter Biden’s Delayed Email Access on the JPMI Laptop

In both a footnote of his reply motion for discovery

1 The prosecution’s opposition briefs reveal some new evidentiary issues (e.g., seizing electronic evidence for the gun charges for the first time pursuant to a December 4, 2023 warrant; using a grand jury in California in connection with the tax case to elicit evidence for already-indicted gun charges in Delaware; seeking a search warrant in December 2023 to search for evidence in support of its charges three months after having charged; testing a leather pouch for cocaine residue in October 2023 that it had in its possession for five years; denying there was Probation’s approval for the diversion agreement) in addition to those raised in Mr. Biden’s motions to dismiss themselves (e.g., how a Delaware agreement for a diverted gun charge and two tax misdemeanors turned into multiple felonies in two jurisdictions following massive political pressure to do just that). Based on the prosecution’s admissions made only recently in its filings, Mr. Biden will expeditiously file a motion to suppress improperly gathered evidence. [my emphasis]

And two footnotes in his motion to compel

3 The search warrant on December 4, 2023, which post-dates the firearm indictment by almost three months, is the first time in the course of this five-year investigation that DOJ obtained a warrant to search the alleged laptop (and iCloud account and backup data) for evidence of federal firearms violations. The prosecution then used that warrant to purportedly review and seize, for the first time, text messages, photos, and other evidence in support of its felony charges, several of which the prosecution cited in its pleadings on January 16, 2024. (See DE 68 at 8–9.) Moreover, that warrant contained testimony (in support of finding probable cause) about the firearm obtained from a witness in a grand jury empaneled in the Central District of California in November 2023 after this indictment had already been brought. Accordingly, the issue raised—as a result of the prosecution’s recent filings—is one to explore at the evidentiary hearing Mr. Biden requested (DE 64) and a motion to suppress which will be filed promptly.


18 Citing District of Delaware Search Warrant No. 23-507M. Unlike the Office’s prior search warrants during the five-year investigation that were for tax, financial, or foreign-business related offenses, this warrant was specifically for offenses pertaining to 18 U.S.C. §§ 922, 924 (firearms offenses). See supra n.3, and a further motion to suppress concerning this December 4, 2023 search will be forthcoming. [my emphasis]

Hunter Biden attorney Abbe Lowell said he would soon be filing a motion to suppress “improperly gathered evidence.”

Part of this will likely be a challenge to the belated pretextual testing of the gun for cocaine residue without also testing for fingerprints and dating of the residue to the time period immediately after Hunter purchased a gun.

But in all three footnotes, he promises to challenge the December 4, 2023 warrant, which would implicate the original search warrant to Apple, the exploitation of the laptop, and follow-on searches for four devices backed up to his iCloud:

  • iPhone X (Apple Backup 1)
  • iPhone 6S (Apple Backup 3)
  • iPad Pro (Apple Backup 4)
  • iPhone XR (Apple Backup 11)

After over three years of controversy about the laptop attributed to Hunter Biden, this challenge may finally unpack the reliability of the device that has driven right wing frothers nuts ever since.

Game on!

There’s a variety of things that Lowell might rely on to challenge the use of the laptop — and possibly, the four backed up devices, as fruits of the laptop — some sound and some less so. They include:

  • A complaint that David Weiss used testimony obtained from a Los Angeles grand jury focused on tax crimes to obtain the December 2023 warrant, which will almost certainly be dismissed as normal prosecutorial dickishness.
  • If any of the devices entirely predate 2018, there should be no probable cause to search them for the 2018 charges. Based on emails available at BidenLaptopEmails dot com, Hunter Biden started using at least three different iPhone Xes in 2018 (but at least one of those was likely lost to hostile people). He had an iPhone 6S with the droidhunter account he used to access adult entertainment in early 2019, though the only known iPhone XR may have been tied to that account, rather than his Rosemont Seneca account (or there could be a later one). Otherwise, his iPhone 6S use appears to have significantly predated 2018. An iPad backed up to the laptop is an iPad Pro, which itself dates to 2016, and much of Hunter Biden’s known iPad Pro use was also in 2016 and earlier, which is the time frame investigators were most interested when they obtained those warrants.
  • The fact that, per Gary Shapley’s notes, the FBI never validated when the files loaded onto the laptop were added to it in the first 10 months they used it (which also means they did not do so before obtaining four backup devices partly relying on it).
  • John Paul Mac Isaac’s acknowledgment that when his father first went to the FBI, the FBI agent with whom he spoke advised, “you should get a lawyer [because] You may be in possession of something you don’t own.”
  • JPMI’s description that the FBI was trying to boot up the laptop on December 9, 2019, before the FBI had the December 13, 2019 warrant.
  • The fact that the Attorney General’s Chief of Staff texted the Attorney General that he was sending him a laptop the day after the FBI obtained the known December 13, 2019 warrant, suggesting the laptop may have been used for something else, like potential impeachment defense.
  • Also per Shapley’s notes, that some of the means FBI used to determine the laptop was once associated with Hunter’s iCloud account — including call and email traffic with John Paul Mac Isaac and a cigar purchase made locally the day of the drop-off — could easily be spoofed by anyone in possession of the laptop.
  • The fact that, for two and a half months by the time the FBI claimed to have validated that the laptop was Hunter Biden’s, they had had full access for Hunter’s iCloud (and almost certainly had access to Hunter Biden’s Rosemont Seneca Google account for at least that long), which would have given them full access to a bunch of metadata that very much should have raised concerns about who had control of Hunter’s devices at any given time.

Those are just some of the potential bases for a Fourth Amendment challenge to using the laptop as evidence. There may be more.

It’s the last bullet that I want to focus on here. Shapley’s notes show that on November 6, 2019 — over a month after obtaining Hunter’s full iCloud account on September 25, 2019 — Josh Wilson used the serial number provided by JPMI and “determined that device was registered to [Hunter Biden] via apple ID account/iCloud account.”

It is absolutely the case that at 8:50AM Delaware time on October 21, 2018 — nine days after Hunter bought a gun and two days before he no longer possessed it — the laptop that would eventually end up at the FBI logged into Hunter’s iCloud account, though unlike some devices before and after, there’s no public confirmation of a tie to Apple directly, such as Apple welcoming him to a new computer or a receipt.

But there’s something unusual about what came next.

Normally, when Hunter Biden started using one of the new devices that can be clearly tied to his account, he would log into iCloud, then shortly thereafter log into one or another of his two Google accounts, Rosemont Seneca and/or droidhunter. As a result, Google would send security alerts to both the Gmail account and a whichever of the iCloud emails were set as backup.

For example, after Hunter bought a new laptop (possibly the laptop found at Keith Ablow’s in March 2019) on August 31, 2018, he signed into his iCloud account the next day, then, also on September 1, signed into his droidhunter Gmail account, then into his Rosemont Seneca account on September 2.

Someone signed into one of his new replacement iPhones, ordered through Asurion, on October 14 and then, on October 17, signed into his Rosemont Seneca Gmail account.

Someone signed into a new iPhone 8 Plus on October 23, 2018 — possibly the other replacement phone from Asurion — and then signed into his Rosemont Seneca Gmail account that same day.

Things are a bit fuzzier with some phones replaced through Apple the next spring, after his life was packed up on a laptop for delivery to John Paul Mac Isaac.

On February 21, 2019, he got a new iPhone, associated with his droidhunter account, and signed in on his droidhunter Gmail right away.

On March 1, 2019, he got a new iPhone XR — possibly the one obtained with the 2020 warrant. Then bought an adult themed App on March 7, then signed into his droidhunter email on March 9.

There are an astounding number of other devices used to log into one or another account associated with Hunter Biden’s digital life. But for recognizable device replacements, the pattern generally holds: Sign into Apple, then sign into Google.

But based on what is available on the public emails, after someone logged into Hunter’s iCloud account with a new laptop on October 21, 2018, it was weeks before a new Mac device logged into his Gmail accounts, starting with a November 16 attempt to log into Rosemont Seneca that was rejected by Google, followed by a reset of the droidhunter account and a login into that on November 20, followed by a login into Rosemont Seneca on November 24. Not only did those attempts come in the midst of a bunch of attempts to get into Hunter Biden’s Twitter account from a Mac. But on November 27, someone appears to have gotten into his iCloud account from Troutdale, OR.

New Mac devices also accessed Hunter’s Rosemont Seneca account on February 9 and February 20, 2019.

As I’ve already described, a great deal of Hunter Biden’s “normal” activity on his devices in this period looked like he was hacking himself. For example, on at least 36 occasions in 2017 and 2018, Wells Fargo shut down Hunter’s online access because of activity that looked, to it, like a hack. Many if not most of that was probably, instead, just Hunter Biden doing erratic things. In other cases, it’s impossible without more data to show whether a particular access or expenditure was Hunter himself, someone who had acquired one of his devices, or someone more malicious.

But there is a pattern, and the laptop ultimately shared with the FBI, he deviated from that pattern.

Certainly, David Weiss might argue that the FBI just hadn’t looked at Hunter Biden’s digital fingerprints that closely when they got a warrant on December 13, 2019.

But they’ve had five years to look at it in the interim period, and might have a harder time arguing that this pattern was normal.

Update: Just catching up to the Delaware docket (JPMI’s suit and Hunter’s countersuit). Judge Robert Robinson will hold hearings in everyone’s motions on February 22.

Update: Abbe Lowell has amended his lawsuit against the IRS, tweaking it to make statements that lawyers for Joseph Ziegler and Gary Shapley made. He told Mark Scarsi had had some motion regarding the disgruntled agents, so I expect this filing will be cited in that motion.

23 replies
  1. EW Moderation Team says:

    A reminder to all new and existing community members participating in comments:

    — We have been moving to a new minimum standard to support community security over the last year. Usernames should be unique and a minimum of a minimum of 8 letters.

    — We do not require a valid, working email, but you must use the same email address each time you publish a comment here. **Single use disposable email addresses do not meet this standard.**

    — If you have been commenting here but have less than 1000 comments published and been participating less than 10 years as of October 2022, you must update your username to match the new standard.

    Thank you.

    • emptywheel says:

      We don’t know what they’ve done since 10/22/2020. But before that they had engaged in truly shameful negligence. both on the laptop and compromises of his other digital accounts.

      • wetzel-rhymes-with says:

        I remember years ago when this laptop first appeared in the news, it seemed like an incredible fiction that the man at the repair shop was legally blind, like it was a story from someone’s imagination. Drop-offs can wash away the chain of custudy, like when that Roger Stone looking character dropped off the Memogate stuff purportedly about George W. Bush years ago that destroyed Dan Rather’s career.

        When the laptop first appeared, I think I remember you suggesting the files might had been altered or damaging material inserted, Burisma stuff, but I don’t think that’s turned out to have been the case. Still, the birth of this laptop and how it got to the IRS and the FBI looks like 100% ratf#ckery, put into the stream as a political instrument to lead to the prosecution of Hunter Biden and damage his dad. It seems like there must be DOJ guidelines regarding what to do if a prosecution is being used as a political instrument this way. Those must not involve seeking the most severe charges.

        • emptywheel says:

          We don’t know if anything was inserted. Because there were so many devices out there, it would have been fairly easy to “insert” false information into his iCloud.

          • wetzel-rhymes-with says:

            I think you are right that my explanations are leaving out that multiple individuals or organizations may have been exploiting and altering Hunter’s data in this time period and before.

            If the laptop had been left at the repair shop because someone wanted evidence of crime to get to the FBI and ultimately to the IRS, the benefit with a legally blind repairman, is that you do not need a Hunter Biden look-alike for the drop-off. That is my theory of the case. The more I believe this happened, the less the laptop at the repair shop can be less “authentic” than the rest of the collection, if the laptop was left at the repair shop as “evidence” for government investigators. If that’s what happened, this whole prosecution from start to finish is still a political hit job even if David Weiss is unwitting.

            • Shadowalker says:

              It definitely was politically motivated. After giving copies to the New York Post, Rudy dropped a copy off at the New Castle County PD on October 20, 2020 (two weeks before the election), claiming there was evidence of crimes and that being a former federal prosecutor he knows what a crime looks like. He was insinuating illegal sex acts on the different news shows. Delaware didn’t know what to do with it, so they handed it over to the FBI. Would be interesting to see what differences there are in the three known copies the FBI has.

  2. EuroTark says:

    Lowell could probably also challenge the probably cause for looking up the records of who owned the gun in the first place, as it doesn’t seem to be linked with any crime or crime scene.

  3. Tech Support says:

    Troutdale? Really?

    Essentially an outer suburb of Portland, Troutdale sits on Interstate 84. If you’re not commuting west into Portland for work, you’re probably heading east to do tourist-y stuff in the Columbia River Gorge. It hosts the biggest truck stop in the metro area.

    11/27 was a Tuesday. A brief skim of the news around that time shows that:

    The Columbia River Historic Hwy had just re-opened a few days earlier after being closed for months following the Eagle Creek Fire.

    Along with the the Dems retaking the house, the 2018 mid-terms were a big win for Ds across Oregon.

    10 days earlier on 11/17, there was violence in Portland between Proud Boys affiliated “Patriot Prayer” and “Portland Popular Mobilization” who held competing rallies in close proximity.

    None of that tells me anything. Maybe it was HB himself vacationing at McMennamins Edgefield.

    • earlofhuntingdon says:

      Don’t knock McMenamins. There are towns along I-5 where a McMenamins is the only game in town.

    • zscoreUSA says:

      On 11/27/18, HB was definitely not vacationing in Oregon.

      He was in Boston, arranging to have a woman fly from LA to meet him in Boston. In fact, an hour before the Venmo account being accessed in Troutdale, Oregon, Hunter texted that woman asking if she still was logged in to his Lyft account on her phone, while in LA trying to get to the airport. An example of someone else accessing his accounts.

      When I saw the Troutdale login, I suspected possibly he was using a VPN, but who knows, definitely a possibility someone else accessed.

      • Tech Support says:

        Given the crowd he was circulating with at the time, having a (private life) malicious user operating out of the ample lodging choices in Troutdale seems far more likely than a political operative.

        To your point though it could very possibly be VPN-related even though AFAIK Troutdale doesn’t host any significant datacenters. Google has a big one up the gorge in The Dalles, and they are all over the place from inner Portland through to the outer SW suburbs. With relatively inexpensive hydroelectric power, any reasonably priced light industrial zone could sport one.

        • zscoreUSA says:

          That’s interesting to know, I never thought about the actual technology behind where VPNs are located. Just from a standpoint that this data probably has a normal explanation, that isn’t evidence of someone hijacking his account. Almost all other Venmo notifications match the location where he physically is located. And the Vegas notifications mentioned on this website previously I believe is him allowing access intentionally to other people in order to facilitate payments to fund such a private life.

  4. zscoreUSA says:

    Hunter left the laptop at Ablow’s in February not March 2019. DEA found it at Ablow’s in February 2020.

Comments are closed.