The Funny Leak Denials of the So-Called IRS Whistleblowers

In the hearing platforming the complaints of two IRS agents who are angry their case against Hunter Biden wasn’t charged as a felony, Joseph Ziegler — who had previously made a big deal of hiding his identity — was given an opportunity to deny being a source for public reporting on the Hunter Biden investigation.

In the exchange, Ziegler only denied being the source for Garrett Ziegler’s site — he was not asked, and he never denied, being a source for other media outlets.

Tim Burchett: It’s also come to my attention that today, after this hearing was already under way, apparently oppo research is circulating from, quote, Hunter Biden’s legal team, unquote, suggestions that you had leaked SARs and other investigative information to someone that had released that information online. Is there a statement that you’d like to make about whether you’ve leaked any investigative information to someone to reveal on the Internet? And I’m sure Hunter Biden’s legal team, who’s obviously watching right now, and these dirt bags are trying to smear you through the press. And it’s disgusting. And I’d appreciate hearing a direct answer from you, Brother.

Ziegler: So there’s two parts to this. There was that release of that bank report, my name was listed in there. So my name was out in the public as one of the IRS agents working this case. And that was maybe two or three years ago. So that came out. And then on top of that, me and my husband were in a report that’s out on social media, on Twitter, by a person with the same last name that I have who I’ve never met, I’ve never turned over information to, we just happen to have the same last name. Okay? I was, for my sexuality, my sexual orientation, my husband was put out there, like information related to me, so it was in an effort to discredit me that I’m this person working for the liberal side and I must, must be a plant. And it was awful the things that they were saying about me. But I can tell you that I’ve never turned over any information regarding this case to anyone related to that Marco Polo report or, someone with the same last name that I have.

It was not, at all, a denial that he was the source for other leaks to the press. It was a very limited denial, limited only to Garrett Ziegler, not generally.

He has made at least one other denial of leaking, which I’ll return to.

For now, I’m interested in the way that his claim, given under cloak of anonymity, that he and his spouse were harassed because his name showed up in the SARs and other legal process at Garrett Ziegler’s site is one reason he gave in his Ways and Means testimony for harping on his sexual orientation — about which of course, no Democrat would give a shit.

I’m an American, and my allegiances are to my country and my government. I’m also a gay man. I have a husband, two dogs, a home, and a life full of family and friends. But above all else, I’m a human being. My sexuality doesn’t define me as a person. It’s just who I love.

I’d like to say one more thing regarding this topic of sexuality, especially since it’s the start of Pride Month. But people have said that I’m gay and people have said, because I’m gay and that I am working as the case agent on this investigation, that I must be a far-left liberal, perfectly placed to fit some agenda. This was stuff that was on social media regarding me.

I can tell you that I am none of those things. I’m a career government employee, and I have always strived to not let politics enter my frame of mind when working cases.

I’ve tried to stay so nonpolitical that in the last Presidential election I voted but had decided to not vote for the Presidential candidate because I didn’t want to be asked that question in a court proceeding in the future and I didn’t want to show any potential bias. [my emphasis]

His sexual orientation is relevant to his testimony to the extent that right wingers harassed him after his name was made public by Garrett Ziegler.

In his opening statement this week, he used his sexual orientation again:

I had recently heard an elected official say that I must be more credible because I am a gay Democrat married to a man.

He can’t be accused of lying because he’s a gay man, he parroted others — who again, must be right wingers — as saying. He couldn’t have an association with efforts to leak the contents of a laptop that started getting packaged up the very same month he himself opened an investigation into a relatively small international tax cheat based off payments to Russian sex workers, his very first investigation in the group, because he would be harassed by associates of someone like Garrett Ziegler for who he is. In both cases, he used his sexual orientation as some measure of credibility, one that would never be convincing for actual Democrats, because Democrats just don’t give a shit (and know well that prominent gay men like Ric Grenell are truly epic right wing trolls). But Ziegler wielded his harassment by presumed frothers as if it ensures he’d never associate with people whose readers would harass a gay man.

Meanwhile, at Wednesday’s hearing, Gary Shapley was asked about leaks several times. In one exchange, Ro Khanna attempted, with limited success, to ask him a series of questions. In Shapley’s first answer, he claimed that he was the one who reported the October 6 to “our Inspector General,” so presumably Treasury’s Inspector General, TIGTA.

Ro Khanna: Let me just ask you on the media. You’ve given testimony under oath that you have never spoken to the Washington Post — any reporter on this matter, correct?

Gary Shapley: That’s correct.

Khanna: Do you know — have you spoken to any media outlet on this matter?

Shapley: Uh, I have spoken, after the House Ways and Means Committee,

Khanna: Before that, have you spoken to any media — journalists on this matter?

Shapley: Absolutely not.

Khanna: Do you know if any colleague of yours at the IRS has spoken to any journalist on this matter?

Shapley: Absolutely not.

Khanna: Do you know of any investigation into the leaks on this matter?

Shapley: Uh, … so the October 6 leak, I was the person who referred it to our Inspector General.

It’s an interesting claim because his own exhibit shows the FBI agent, Darrell Waldon, responding to Shapley’s email, which Shapley sent after 6PM on Friday October 7, before 8AM on the Tuesday after a Federal holiday, saying that he, Waldon, would take care of that referral.

It may be that Shapley did make a referral, either via email over the weekend or after receiving an email saying someone else was taking care of it. It may also be that Shapley made his own referral even after Waldon did, which sure might raise questions at TIGTA. But Shapley’s own document raises questions about this claim.

As Khanna attempted to question Shapley further, Shapley kept talking over him, reciting an obviously rehearsed response.  James Comer even tried to force Khanna to relinquish his time so Shapley could answer the question Shapley wanted to answer before Comer realized that’s not how it works.

Khanna: Do you know if any of your colleagues are under investigation —

Shapley: There was a leak on December 9, 2020, around the day of action. And I know the IRS Inspector General and DOJ IG are looking into…

Khanna: Do you know if any of your colleagues are under investigation? Sorry, if I could just finish. Do you know if any of your colleagues are under investigation for that leak?

Shapley: I know of no colleague under investigation for that leak [glances towards the Chair].

Khanna: And just for the record, it is your testimony under oath that you have never spoken to any media person before the House testimony about this matter?

Shapley: It’s not only my testimony under oath today, I’ve provided an affidavit to the House Ways and Means Committee saying the same. I’ve said it to our Inspector General’s office as well. [Crosstalk]

Khanna: I appreciate that. I just want to make a final point on this. One, I think that —

Shapley: Mr. Chairmain, you mind if I — [Shapley’s lawyers consulting behind him]

Comer: Can the Gentleman answer the question you asked, Mr. Khanna?

Khanna: I just don’t want my time to be–

Jamie Raskin: If you’re granting him the time, Mr. Chairman.

Khanna: I just want a minute to wrap up if you’ll give me time.

Comer: Okay, you have a minute.

Shapley was asked about leaks twice more, both times by Dan Goldman. In the first instance, Goldman asked how the October 6 leak came up in the October 7 meeting.

Goldman: You’re familiar with an October 6 Washington Post story entitled Federal agents see chargeable tax gun purchase case against Hunter Biden, is that right?

Shapley: Yes I’m familiar yes.

Goldman: And this was, this meeting occurred October 7, the day after this, right?

Shapley: That’s correct.

Goldman: Was this article discussed at that meeting?

Shapley: It was.

Goldman: And what was the nature of the discussion?

Shapley: Uh, it’s in that document, that email, that basically says we’ve got to keep the sphere small–

Goldman: So it’s pretty clear, you would agree, that this was a leak to the Washington Post by law enforcement agents since it describes what Federal agents believe, right?

Shapley: So it wasn’t actually clear to me that it was because usually they’ll say that it’s a law enforcement source that provided it, and if you see at the bottom it says they corroborated independently and they did not mention law enforcement. [Shapley’s attorney leans over to whisper to him]

Goldman: You don’t think it’s a Federal agent, agents, who leaked this when the headline says, Federal agents see chargeable tax gun purchase case against Hunter Biden?

Comer: Gentleman’s time is expired but feel free to answer the question.

Shapley was being questioned. But Ziegler piped in and offers up a December 9, 2020 leak.

Ziegler: So there, prior to that if you go back to December of 2020, there was another leak to the Washington Post that got, we had to get Department of Justice OIG involved, TIGTA involved so there was other leaks that happened prior to this to the Washington Post that I think, are important for us to understand as well.

Shapley: It has similar information as the October 6 leak.

It’s interesting that Ziegler piped in here, because answering a question about October 6 by raising the December 9, 2020 leak is what he did in his House Ways and Means testimony, too. Ziegler described that he told TIGTA that he believed a December 9, 2020 leak came from DOJ or (!!) the defense. He also described that “we would constantly be talking about” this subject.

Prior to this, there were other leaks. After our day of action in December of 2020, we got word that a couple of the news sources were going to release an article on the investigation. This was a couple days prior to us going public — going overt.

So that leak happened, and nothing changed after that one. And everything indicated, even in communication in meetings from what I recall — we thought that the leak was potentially from someone in [the] Department of Justice. So we would constantly be talking about, yeah, it’s not an IRS person. It’s not anyone on the team. It’s always — it appeared like it was someone from Department of Justice. So that’s what kind of shocked me with this moving forward.

I was interviewed by an investigator — I think they were with TIGTA. I told them, I didn’t leak anything. I thought that the leak might have come from either defense counsel, or from DOJ like the other ones came.

But back to Wednesday’s hearing. Goldman asked Shapley again about leaks in a later round.

Goldman: Gentlemen, I want to return to the Washington Post October 6 article and I’d ask unanimous consent to enter it into the record. In your testimony, Mr. Shapley, before the Ways and Means Committee, you stated, quote, there was a leak, it appeared to come from the agents level, who was critical of the prosecutors for not charging the case. What you testified earlier was a little different. Which one do you stand by today?


Shapley: I’m sorry, could you repeat that?

Goldman, quoting: “There was a leak, it appeared to come from the agents level, who was critical of the prosecutors for not charging the case.”

Shapley: Yeah, I said it appeared, because I said it came from the agents’ level, but the source was a source familiar with the topic and it didn’t say it was a law enforcement source.

Goldman: Okay, that seems to be a distinction without a difference. And then, you understand that, obviously leaks of grand jury information is a felony, right?

Shapley: Leaking investigative information including 6103 would be a felony, yes.

Goldman: Well that’s true as well. So would you agree that there would be some skepticism from prosecutors about which of the agents may be the source of a leak?

Comer: Gentleman’s time is expired but feel free to answer the question.

Shapley: Since there have been multiple leaks in this investigation, and the one on December 8 or December 9, 2020, it appears to come from someone, as Lesley Wolf stated —

Goldman: I was just asking about October 6, 2022.

Shapley: So I

Goldman: It would cause anyone suspicion, right?

Shapley: If it says it comes from an agent level. [His attorney leans over, whispers something.]

Goldman: That’s what you said.

Comer: Gentleman’s time has expired.

Now, Goldman didn’t actually quote Shapley exactly. Here’s the full quote from Shapley’s Ways and Means testimony.

Q In No. 1 on this email you prepared, says: “Discussion about the agent leak — requested the sphere stay as small as possible…DOJ IG will be notified. FBI — HQ is notified.”

What was the specific leak?

A So there was a leak, I’m not sure what outlet, on October 6th of 2022 — it appeared to come from the agent’s level, who was critical of the prosecutors for not charging the case.

Q Okay. Talking about the Hunter Biden case?

A Yes, not charging the Hunter Biden case.

So, obviously that was part of the discussion at the beginning. And there have been multiple leaks in this case going back, and this one was handled a lot differently because I guess it was purportedly from the agent’s level.

So this drastic — you know, they used that as an excuse to kind of — to do what they were doing to us after this meeting on the 7th, they kind of used that leak as an excuse to exclude us.

In context, the view from others was that this was an agent level leak. Given his later use of the word, “purportedly,” I’m not sure it was Shapley’s espoused view.

I’m more interested in other aspects of this exchange.

In May, when Shapley answered a friendly question from the Majority Counsel, he feigned uncertainty what outlet this was from. In July, in public, Shapely kept answering questions about the October 2022 leak by responding about the December 2020 leak — and Ziegler explained they were doing so because “there was another leak to the Washington Post,” which by his telling they talked about all the time.

More interesting, though, is Shapley’s claim that, “this [leak] was handled a lot differently because I guess it was purportedly from the agent’s level.”

Both he and Ziegler described that this leak was the excuse to start excluding the IRS agents from the case.

But Shapley’s claim that the October 2022 leak was treated differently is likely false.

As I noted in this post, there was another leak, to the NYT in March 2022 (right after the IRS agents submitted their prosecution memo and asked DC to partner on it). That same month, for what Shapley presents as discovery purposes, everyone was asked for their email. But even though he had attempted to interview Hunter Biden himself in December 2020, he didn’t comply with that request.

It is common practice for DOJ to ask for the case agents’ communications in discovery, as they might have to testify in court. However, it’s much more unusual to ask for management communications, because it is simply not discoverable.

In March of 2022, DOJ requested of the IRS and FBI all management-level emails and documents on this case. I didn’t produce my emails, but I provided them with my sensitive case reports and memorandums that included contemporaneous documentation of DOJ’s continued unethical conduct. [my emphasis]

After the October meeting, prosecutors came back to Shapley, and asked again, which he got really touchy about.

[T]his was the culmination of an October 24th communication from Delaware U.S. Attorney’s Office and — well, it was really Lesley Wolf and Mark Daly who called the case agent, [redacted], on the telephone and said, hey, we need — we need Shapley’s emails and his — these sensitive case reports that he’s authored back to May.

And they didn’t ask for discovery for anybody else. They didn’t ask for, from the — mind you, the agents had provided discovery March-April timeframe, so there was 6 months or so of additional discovery, and they’re not asking for that, right? They’re only asking for mine.

So [redacted] sends me an email with Wolf and Daly on it that says, hey, you know, they asked for this, you got to talk to Shapley. I respond, hey, yeah, I’m available 9:15, let’s chat. And she sends that, she forwards my email to Shawn Weede, number [two] — a senior level at Delaware U.S. Attorney’s Office.

And then he contacts me about this discovery, and he’s kind of putting a lot of pressure on me. So even Weiss called up, the deputy chief, to complain about timing of the emails that got turned over from me at that request. [my emphasis]

It appears that it’s not that DOJ treated the leak differently, it’s that they noticed that the first time they asked for emails, he had blown off the request.

Again, as I noted here, as Darrell Waldon, the same agent who said he’d take care of the TIGTA referral, started reviewing his emailsShapley asked for advance notice of anything suspicious — precisely the thing he said Hunter Biden should not get.

If you have questions about any emails I would ask you share it in advance so I can look at them and be prepared to put them into context. The USAO was so eager to got my emails (which they already had 95% of) … then surprise … they “might” have a problem with a few of them that memorialized their conduct. If the content of what I documented, in report or email is the cause of their consternation I would direct them to consider their actions instead of who documented them.

I have done nothing wrong. Instead of constant battles with the USAO/DOJ Tax, I chose to be politically savvy. I documented issues, that I would have normally addressed as they occurred, because of the USAO and DOJ Tax’s continued visceral reactions to any dissenting opinions or ideas. Every single day was a battle to do our job. I continually reported these issues up to IRS-CI leadership beginning in the summer of 2020. Now, because they realized I documented their conduct they separate me out, cease all communication and are not attempting to salvage their own conduct by attacking mind. This is an attempt by the USAO to tarnish my good standing and position within IRS-CI … and I expect IRS-CI leadership to understand that. As recent as the October 7 meeting, the Delaware USAO had nothing but good things to say about me/us. Then they finally read “discovery” items (provided 6 months previous — that are not discoverable) and they are beginning to defend their own unethical actions.

Consider the below:

  1. I am not a witness — therefor Jencks/impeachment is not an issue.
  2. I am not the receiver of original evidence nor engaged i any negative exculpatory language against the subject … My documentation only shows the USAO/DOJ Tax’s preferential treatment of this subject. [bold underline original, italics mine]

Shapley’s boss, Michael Batdorf, was, at that point, quite supportive of the possibility that Shapley would have concerns about prosecutorial misconduct. Two months later he began to put a hold on what Shapley and others were doing.

I don’t think any of this shows that these IRS agents were leakers one way or another, and I also think it likely that whoever did some of these leaks used a cut-out.

Shapley may not be the leaker. But he sure seems to be hiding stuff in his emails. And only after his emails got turned over did he start claiming to be a whistleblower.

WaPo Is Suppressing Information that Might Debunk Devlin Barrett’s Latest Spin

Last week, I asked the WaPo if they would release the two reports — one from Johns Hopkins professor Matt Green and the other from InfoSec expert Jake Williams — that were the basis of this report on the “Hunter Biden” “laptop.”

I had asked once before, in May 2022.

But since I had originally asked, a bunch of things had happened to make those reports more newsworthy. Hunter Biden had countersued John Paul Mac Isaac (here’s the WaPo’s report). James Comer has stumbled over and over in his unabashed effort to manufacture a scandal (in which the WaPo has played along, still treating it as a credible investigation). Delaware US Attorney David Weiss’ office released a plea deal to which Hunter Biden is expected to plead guilty next week (here’s the WaPo report). IRS agents claiming to be whistleblowers, Gary Shapley and Whistleblower X, shared notes that raised questions about the FBI treatment of the device (but WaPo didn’t mention that in their report). Abbe Lowell claimed that Shapley misidentified Hunter Biden’s interlocutors in some key WhatsApp messages (something else WaPo didn’t mention even while repeating the substance of the contested WhatsApp texts). Denver Riggleman, who has been working as part of a Hunter Biden team to examine what has been released, has alleged some of the data has been manipulated (something WaPo hasn’t bothered to cover at all).

That all led me to start looking at the publicly released (but unreliable) emails at BidenLaptopEmails dot com, where I’ve discovered that during a period when Hunter Biden was getting Ketamine treatment and bookended by two communications from him that indicated he was not getting outside comms, someone:

  • Split Hunter’s Uber account, on which his two iCloud accounts had previously been joined
  • Accessed Hunter’s rhb iCloud account from a browser
  • Changed the password and related phone numbers to his rhb iCloud account
  • Installed and gave full access to his droidhunter gmail account a real app, called Hunter, that can send email on someone else’s behalf
  • Signed into that droidhunter account using a new device
  • Again changed emails and phone numbers associated with his rhb account
  • Asked for a full copy of his rhbdc iCloud account
  • Reset the password of that rhbdc iCloud account
  • Made droidhunter account the notification email for the rhbdc account
  • Downloaded all Hunter’s Apple Store purchases
  • Made changes to the Uber (and Waze) account associated with an XS phone that would be included in the “laptop”
  • Restored rhb as an alternate address to the account
  • Restored contacts from an unidentified prior change
  • Obtained — including at the droidhunter email account — a download link of the entire rhbdc iCloud account
  • Backed up the XS phone to the laptop
  • Gotten a trial app of a photo editor
  • Backed up an iPad to the laptop
  • Changed the iTunes password
  • Added the Dr. Fone account, allowing you to adopt a chosen second phone number for a phone, to a second of Hunter’s accounts
  • Signed into the droidhunter account from a burner phone
  • Restored the prior trusted phone number
  • Added software that could record calls
  • Started erasing and then locked a laptop — probably the one that would eventually end up in Mac Isaac’s store
  • Got a new Mac phone for the droidhunter account

That series of changes are not the only emails in the MarcoPolo set that should raise questions about whether Hunter Biden’s digital identity may have been compromised.

Two that are important to the topic of this post are, first, that a great many devices logged into Hunter Biden’s iCloud accounts in 2018 and 2019, yet many of them don’t appear to be tied to him getting his own new iPhone or computer, and only rarely are the existing devices shut down or passwords changed afterwards. The sheer number should have raised alarms that people had broken into Hunter Biden’s iCloud accounts when the IRS asked Apple for Hunter Biden’s subscriber information in November 2019, in advance of writing a subpoena for the laptop in custody of John Paul Mac Isaac. Additionally, there were a bunch of attempts to get into Hunter Biden’s Venmo account, and the account added two new Remembered Devices within 12 minutes of each other in August 2018, one in the LA foothills and the other in Las Vegas. That and other details (including texts and emails) might have raised questions about whether sex workers from the very same escort service on which the IRS had predicated this entire investigation took steps to compromise Hunter Biden’s devices.

But the timeline above provides some reason to believe that at the time the “laptop” was packaged up for delivery to John Paul Mac Isaac, Hunter Biden did not have complete — if any — control of his own communications.

I wouldn’t be able to prove whether Hunter Biden was hacked during this key period in 2019. It would require subpoena power and access to reliable data. But as it happens, Whistleblower X had subpoena power — and was already watching Hunter Biden closely — in precisely the period this happened.

For those of us who don’t have subpoena power, though, we have to rely on publicly available evidence, filtered through partisan gatekeepers alleged to have tampered with the device.

The two reports done for the WaPo are the only known assessments of the drive containing the “laptop” primarily using forensic — as opposed to a correlative — methodology. The correlative methodology, which shows all the communications on the drive confirm the others, unsurprisingly concludes that the “laptop” came from one of Hunter Biden’s several iCloud accounts.

The forensic methodology looked for digital verification — not just of email signatures, but also of the drive itself. Both Green and Williams raised questions about the treatment of and missing digital signatures on the drive, questions that seem to match what Riggleman’s team is seeing.

Indeed, the concerns that Green and Williams raised may explain something the FBI itself found. Shapley’s notes recorded that on March 31, 2020, someone wrote an email “about quality and completeness of imaged/recovered information from the hard drive” — an email that was being intentionally withheld from the agents (especially Whistleblower X) who might one day testify at trial.

This sounds like it might reflect the same concerns raised by anyone external examining the drive forensically. If it does, it would suggest that some of the irregularities everyone can see in drives released via Rudy Giuliani and Steve Bannon always existed, including in the one shared with the FBI and in any separate drive shared with Republicans in Congress.

Because of all the new questions raised about the “laptop,” and because of the centrality that the Republicans want it to have on the upcoming election, I thought it reasonable to ask the WaPo to do what even the Washington Examiner was willing to do: show their work. While the Examiner’s report from Gus Dimitrelos tellingly excludes many of the details I’ve laid out above and hides both some key later device accesses and types of apps — especially spyware — loaded onto Hunter Biden’s iCloud accounts, while the way the Examiner released it exacerbated the privacy violations on Hunter Biden himself, it nevertheless was useful for explaining how two iCloud accounts were loaded up onto one laptop and how the government was able to obtain WhatsApp texts that don’t show up on the unencrypted parts of the laptop.

After I made several requests, WaPo PR manager Savannah Stephens declined to release the reports, calling the two reports, “foundational reporting documents.”

Marcy, thank you for reaching out. We do not release foundational reporting documents. Our coverage at the time was transparent about how the study was conducted, including this report.

Even though it has two reports that could significantly impact fairly pressing debates — debates the WaPo itself treats as important — the WaPo refuses to release more on these expert reports on the laptop.

Instead of doing that, the WaPo is instead paying Devlin Barrett to do what he does best — write down as true what right wingers tell him to write, not what the public evidence actually shows.

In a story with Matt Viser (the same guy who repeated the content of contested WhatsApp texts without revealing that Abbe Lowell had contested them), Barrett wrote that the testimony of the men he calls “whistleblowers” “show Hunter Biden’s laptop had little role in the investigation into Hunter Biden.”

Barrett and Viser utterly misrepresent the debate over the laptop — dodging the question, in the lede, at least, of whether the laptop can help get to the truth — something once considered the purview of journalism and something WaPo’s own report on this drive had previously done.

For more than two years, Democrats and Republicans have hotly debated the importance of the “Hunter Biden laptop” — insisting that it was either key evidence of corruption or fool’s gold meant to con 2020 voters into abandoning then-candidate Joe Biden.

Both theories were largely wrong, according to two of the agents closest to the investigation of tax crimes allegedly committed by President Biden’s son.


But the agents’ accounts also indicate that the laptop played at best a small role in the criminal investigation into potential tax and gun-purchasing violations. Far from a smoking gun, the laptop appears to have been mostly an afterthought to the reams of text messages, emails and other evidence that agents gathered from Hunter Biden’s cloud data. A lawyer for one of those agents said he nevertheless was frustrated by the Justice Department’s refusal to let them review the laptop’s contents.

I’m very interested in the project of this column, because not only is this not what Shapley and Whistleblower X’s testimony said, but it misrepresented and misunderstands how evidence works.

This is a tax investigation. It came from, per Whistleblower X, his examination of what is probably a Russian escort service. But it’s a tax investigation: it relies on financial data that comes directly from banks and other financial institutions, institutions that are — to the extent they aren’t tainted by identity theft or hacking, like people seem to have tried to do to Hunter Biden’s Venmo — inherently reliable.

As for emails and texts, the IRS agents’ testimony (taken in conjunction with the report that the Washington Examiner was ethical enough to release), shows that the IRS didn’t obtain what is probably Hunter Biden’s rhb iCloud account — from which the cited, contested WhatsApp messages were probably obtained a second time — until August 2020, after it got some of the same material on the laptop. That potential taint may be why someone told Barrett to downplay the import of the laptop.

While the laptop may not have played a key role in substantiating a tax case against Hunter Biden, it may well have tainted the evidence in the case. It may well be part of the reason why Hunter Biden is getting to plead to misdemeanor rather than felony tax charges — because as even Whistleblower X explained that he had been told, there are emails that raised concerns about whether this could be charged at all, suggesting this case couldn’t withstand discovery.

Plus, WaPo is being coy here: The laptop may have played little part in a tax investigation reliant on bank records. But it did play a central part in allegations, including WaPo’s own reporting, of foreign influence peddling involving (among others), Burisma, the hack of which became public between the time the IRS started using this laptop as evidence and the time they learned Rudy Giuliani had a role in it.

That part is all pitch, though — yet another instance where Devlin Barrett writes down what right wingers tell him to say and WaPo reports it as if it were true. It’s what WaPo pays him to do.

It’s the claims about the laptop — from an outlet sitting on two reports that raise questions about its reliability — that I find especially curious. Start with this paragraph, which conflates the steps FBI took in November 2019 to authenticate that the laptop was Hunter Biden’s — subscriber information from Apple, a purchase record in Delaware, two but maybe only two phone calls with Mac Isaac, and “other intelligence” — with what the AUSA on the case said about it almost a year later.

After being handed the device by a Wilmington, Del., computer shop owner in 2019, the FBI quickly concluded by examining computer data as well as Hunter Biden’s phone records that the laptop was genuinely his and did not seem to have been tampered with or manipulated.

That last bit — “did not seem to have been tampered with or manipulated” — published by an outlet sitting on two reports that show the laptop was tampered with? It is a paraphrase from a meeting in October 2020, not a description of legal process served in November 2019. And therein lies a big part of the scandal.

In the actual quote, Wolf — painted as the bad guy here by the IRS agents — was saying that it “is not a priority” for the investigative team to see “if anything was added to the computer by a third party” even after learning that the lawyer for the President, whose demands for this investigation had raised influence problems from the start of the investigation, had some kind of tie to it.

This is as if Peter Strzok, rather than just failing to make sure people writing FISA applications had adverse information about the Steele dossier (which is what frothers think the IG Report showed), had instead said, “fuck it, I don’t care if it is tainted.” These notes show the Hunter Biden investigative team did what right wingers accuse the Crossfire Hurricane team of doing, blowing off the import of the involvement of a campaign in a key piece of evidence.

When the WaPo conflates those two items again later in the piece, they date the quote to May 2020.

Democrats suggested the data might have been doctored or possibly a Russian-backed disinformation campaign. The information provided by IRS agents to Congress seems to put both the accusations and counter-accusations to rest.

FBI agents were able to determine in early November 2019 that the device they had was registered to Hunter Biden, and phone records showed he had been in contact with the computer shop owner.

“We have no reason to believe there is anything fabricated nefariously on the computer and or hard drive. There are emails and other items that corroborate the items on the laptop,” Shapley wrote in notes that dated that determination to around May 2020.

Dating Lesley Wolf’s comment saying they had no reason to believe anything on the laptop was fabricated to May 2020 is either a deliberate error or a confession that two journalists proclaiming the laptop to lack any taint have no fucking clue what they’re reading.

Wolf said this, at a meeting the investigative team had on October 22, 2020, in the wake of the discovery that Rudy Giuliani had some tie to the laptop, as the team scrambled to memorialize how they had treated a key piece of evidence about which a bunch of questions would now be raised.

A Yes. So there are a couple significant parts of this. One was that, at this time, the laptop was a very big story, so we were just making sure that everything was being handled appropriately.

So we wanted to go through the timeline of what happened with the laptop and devices.

Because the laptop had become a huge story, “we were just making sure that everything was being handled appropriately,” Devlin Barrett’s star “whistleblower” explained.

And Shapley shows Wolf saying that they had no knowledge, in October 2020, of any fabrications on the laptop. But he records her saying that after “computer guy” said “they could do a csv list that shows when everything was created.”

That is, Wolf said this after “computer guy” described something they had not yet done ten months after obtaining the laptop, had not yet done two months after getting warrants relying on the laptop, that they would need to do to make sure the laptop had not been altered by third parties. Wolf said this after “computer guy” described that the FBI had not done very basic things to verify the integrity of the laptop they should have done ten months earlier, before relying on it.

Again, I’m not sure whether WaPo’s journalists are dishonest or just stupid. But this exchange is critical for another reason. Lesley Wolf’s assertion about the integrity of the laptop relied on correlation: by matching emails on the laptop with emails that could be obtained directly from the provider.

There are emails and other items hat corroborate the items on the laptop and hard dive.

This is the method that Washington Examiner’s expert used to proclaim the laptop authentic. It’s the method that a bunch of other right wing journalists have gotten experts to use to validate the laptop.

If you steal someone’s iCloud account, the way to prove that it is authentic is by proving that it is their iCloud account, which is what correlation does.

But “computer guy” was suggesting using a forensic method, ten months after the fact, to test the integrity of the laptop itself. DDOSecrets has done this test on the publicly released emails — and half of them have a last modified date of February 11, 2019, right towards the end of the timeline I show above.

Lesley Wolf made her comment on October 22, 2020. No one in Gary Shapley’s interview asked him what happened after that. Nor does Devlin Barrett seem curious to ask.

If “computer guy” subsequently did this test, there’s good reason to believe he would have found what DDOSecrets did: that while these emails match the ones in Hunter Biden’s accounts, they were all packaged up on February 11, 2019, at a time it’s not clear Hunter Biden had control of his own digital accounts.

If you use a forensic method to validate these files, you’re not going to get the same results as a correlative method. That’s why it would be very useful for the debate about the laptop for WaPo to share the two known expert reports done using forensic methods on the drive itself, rather than correlation.

There’s one more hilarious thing about this Devlin Barrett creation. He, predictably, repeats his “whistleblower’s” complaints about not getting stuff pertaining to the laptop.

Shapley said a federal prosecutor on the case, Lesley Wolf, told him that the IRS agents couldn’t see the laptop. “At some point, they were going to give a redacted version, but we don’t even think we got a full — even a redacted version. We only got piecemeal items,” Shapley told the committee, voicing his frustration that he would have liked to see all the data.

Devlin Barrett — dishonest or stupid? — quotes Shapley’s testimony out of context. The full quotation makes it clear Shapley is referring, again, to a discussion that took place on October 22, 2020. More importantly, Shapley is not referring to the laptop!!

And when it came down to item number 33 on page 2, Special Agent [Whistleblower X] is saying like, well, I haven’t seen this information. And AUSA Lesley Wolf says, well, you haven’t seen it because, for a variety of reasons, they kept it from the agents. And she said that at some point they were going to give a redacted version, but we don’t even think we got a full — even a redacted version. We only got piecemeal items [my emphasis]

That particular quotation, identified clearly as item number 33, is the report about the laptop — which I’ll copy again here to make it so easy even Devlin Barrett might understand it:

To help a right winger allege corruption, Devlin Barrett quotes his complaint that his team was not given the actual forensic report about the laptop. Corruption, in this story, is withholding a forensic report that might tell people what they need to know about the laptop.

And yet that is precisely what WaPo itself refuses to do: release two reports that raise questions about the quality and completeness of the drive.

According to Devlin Barrett’s own standard — at least the standard he applies when he’s parroting right wingers — withholding such a report is a sign of corruption.

Even the plain language of Gary Shapley’s contemporaneous notes show that Devlin’s claim that, “information provided by IRS agents to Congress” “put[s] … the accusations” that “the data might have been doctored or possibly a Russian-backed disinformation campaign” … “to rest” is wildly false (dishonest or stupid?). It does the opposite: It shows that ten months after beginning to rely on the laptop, the FBI still had not done basic forensic checks of the data on it and the AUSA leading the investigation didn’t think doing so was a priority.

That should be the story. That’s the scandal.

And true to form, Devlin Barrett spins the exactly opposite tale.

The WaPo has in its possession some of the only available information that can help to explain what the FBI saw by March 2020, two independent equivalent reports to the one that Shapley implies it is corrupt to withhold.

And unlike the Washington Examiner, they won’t release it.

“I can get any source on the planet.” The Pre-History of Gal Luft’s Pre-“Whistleblower” Indictment

In this post I noted that Gal Luft — the guy who got James Comer all hot and bothered about having a “whistleblower” confirming his conspiracy theories about Hunter Biden — was indicted on November 1, 2022, before the Republicans even won back the House. The timing alone debunks Luft’s and GOP claims that he was charged as retaliation for coming forward to Republicans.

But he might have been charged even before that.

That’s because the statutes of limitation for many of the substantive charges against him — save the alleged conspiracy to violate FARA — would have expired before he was indicted if he hadn’t fled the country when the person referred in his indictment as co-conspirator-1, Chi Ping Patrick Ho, was arrested in November 2017.

Here’s what the charges, duration, and five year Statute of Limitation looks like for the indictment against Luft.

It seems exceedingly likely that SDNY charged Luft on November 1, 2022 because that’s the day the Statute of Limitations would otherwise have expired on the headline charge: the conspiracy to get James Woolsey to act on behalf of CEFC by using Luft’s NGO as a cut-out.

But the five year Statutes of Limitations would have started expiring on the other substantive charges starting in November 2020.

DOJ could still indict Luft on those charges because — as they allude to in the indictment — once his alleged co-conspirator Patrick Ho was charged in November 2017, he fled the US and never returned.

Since the arrest of an associate (“CC-1”) on different U.S. charges in mid-November 2017, LUFT has remained outside the United States.

The known Luft docket doesn’t show any complaint prior to the indictment. But SDNY doesn’t always include prior charges in the prosecution docket (note, for example, that the Oleg Deripaska docket starts with a superseding indictment as document number 1, thereby hiding the timing and content of the prior indictment).

But if DOJ wanted to preserve those other charges until such time as they indicted on the last-expiring one, they might have obtained one or several serial complaints charging them, in case Luft ever happened to fly into the US unexpectedly, which would otherwise have cause those Statutes of Limitation to expire. If that’s right, then SDNY may have started charging Luft as early as November 2020, with more controversial charges involving Iran and Libya the following year.

With that in mind, I want to look at what the Patrick Ho prosecution — Luft’s alleged co-conspirator in counts 1 and 2, as well as Hunter Biden’s associate and legal client through the beginning of Ho’s own prosecution in 2018 — says about the investigation into Luft.

Based on search warrant return dates, DOJ appears to have obtained probable cause against Ho by June 20, 2016 — possibly based off a FISA warrant noticed during the prosecution. Before his arrest, DOJ continued to obtain Ho’s cloud communications at least through March 6, 2017 — meaning they were collecting communications Ho had with Luft during the period he was cultivating the Woolsey deal, and would have been collecting emails with Hunter Biden, except — unless I fucked up the search — none of the noticed email accounts show up in the MarcoPolo set.

While it’s clear CEFC did use charity to try to cultivate Hunter Biden, it’s not entirely clear what role Ho’s NGO played in that process (or whether Hunter had direct involvement with it). It’s worth noting on this point, charges against the Chadian whom Ho was convicted of trying to bribe were dropped. And Woolsey is not known to have been charged, in part because the Chinese payments to him were too well laundered through (allegedly) entities like Luft’s own NGO — likely the same reason why Tony Podesta wasn’t charged for involvement in Paul Manafort’s Ukrainian influence peddling.

Ho was first charged by complaint on November 16, 2017, then arrested as he landed in JFK two days later. On his arrest, the FBI took possession of six USB drives, at least two phones, and an iPad, all of which they presumably searched.

In the wake of Ho’s arrest, DOJ took other overt steps, which they cited in a detention filing to describe how much more they learned after Ho’s arrest. Those steps including interviewing witnesses, executing search warrants — including for Ho’s Virginia NGO, and subpoenaing documents from third parties.

The government first publicly mentioned the arms and Iran conduct subsequently charged against Luft in an October 2018 motion in limine. Because Ho seemed to be preparing to claim his involvement in Chad and Uganda — the two countries he was charged with attempting to bribe — involved charity, a defense that would have skirted aspects of the charged crime, Foreign Corrupt Practices Act, the government argued they should be able to introduce evidence that Ho was pushing CEFC business, not just charity.

On October 2014, the defendant sent his assistant an email stating, “I am going to BJ [i.e., Beijing] this Friday to see [the Chairman of CEFC NGO and CEFC China] on Sat afternoon. The documents I want to send him before hand in separate items are: . . . 7. Iranian connection (brief).”4 On the same date, the defendant sent his assistant another email, attaching a document, which stated, in pertinent part:

7) Iranian Connection . . . Iran has money in a Bank in china which is under sanction. Iran wishes to purchase precious metal with this money. The precious metal is available through a Bank in HK which cannot accept money from the Bank in China which holds the money but is under sanction. The Iranian agent is looking for a Chinese company acting as a middle man in such transactions and will pay commission. (details to be presented orally) The Iranian connection has strong urge to establish trading relationship with us in oil and products . . . .

The following year, in June 2015, the defendant received an email that stated, in pertinent part: “The Iranian team will arrive in BJ . . . . See the attached.” The attachment referenced in the email was a PowerPoint presentation entitled “Presentation to Potential Partners Iran Petroleum Investments.” The next day, the defendant forwarded the email to his assistant, stating, “For writing report to [the Chairman of CEFC NGO and CEFC China].”

The following year, in June 2016, the defendant emailed another individual, blindcopying his assistant, and stated, in pertinent part, “Will get [two executives of CEFC China] to meet with [oil executive at company with operations in Iran] in BJ, and [another individual] also on another occasion if he comes. You can start organizing these. . . . Other matters ftf [i.e., face to face].” [paragraph 78]


The defendant also sought to and did broker arms transactions unrelated to the Chad and Uganda schemes charged in this case. For example:

In March 2015, an individual sent the defendant an email, stating, “I have the list and end user agreement. Pls advise next step.” On the same day, the defendant replied, in pertinent part, “Find a way to pass them onto me and we can execute that right away[].” The individual replied, “Attached. [W]e have the funding and processing mechanisms in place. If it works nice there will be much more. Also for S. Sudan.” The attachment to this email was a document entitled “End User Certificate,” certifying that the user of the goods in question would be the Ministry of Defense of the Republic of Libya. The goods listed on the document included numerous arms. [paragraph 48]

The following month, the defendant sent an email that stated in pertinent part: “It so turns out Qatar also needs urgently a list of toys from us. But for the same reason we had for Libya, we cannot sell directly to them. Is there a way you could act as an intermediary in both cases?” The person whom the defendant emailed replied: “Qatar good chance bc there is no embargo. Libya is another case bc going against an embargo is tricky.” The defendant responded: “Qatar needs new toys quite urgently. Their chief is coming to China and we hope to give them a piece of good news. Please confirm soonest.” [paragraph 48]

As linked above, several of the documents described in this motion describing “other uncharged conduct” are documents listed in Luft’s own indictment. Given that he fled upon Ho’s arrest, he seems to have recognized the threat to himself at that point, in 2017. If not, the public docketing of these documents should have made that clear.

The government repeated these references to communications with Luft — among other places — in their sentencing memorandum for Ho, submitted on March 18, 2019, just days before the meeting with Luft in Belgium.

So Luft was on notice about this part of the criminal investigation into him when he arranged that meeting and pitched dirt on Hunter Biden. The meeting was literally days after Ho was sentenced on March 25, 2019.

SDNY didn’t charge Ho with either of the conspiracies in which he is named as Luft’s co-conspirator, even though their understanding of the arms control conspiracy was well-advanced by the time of his trial in November 2018. He remained imprisoned in the US until June 8, 2020, well over a year after the interview with Luft, after which Ho was deported to Hong Kong. Admittedly, that was the height of the pandemic and Ho was already 70, and so would have been difficult to keep jailed.

But the timing of Luft’s meeting with the SDNY and FBI — literally days after Ho’s sentencing — suggests that SDNY took that opportunity to advance the several overt prongs of the investigations against him, regardless of what dangle — true or not — about Hunter Biden Luft offered. They had already, publicly, made clear they believed it was criminal conduct.

Luft was on notice about that before the Brussels meeting and, as alleged in the indictment, he lied about the arms control scheme and discussions with Iran.

It probably would have been easier to extradite him from the US Embassy in Brussels than it would from Cyprus, so clearly SDNY wasn’t ready to arrest him yet.

There’s no False Statements charge in the indictment pertaining to Woolsey, however, so it’s unclear whether the FBI asked Luft about that.

Trump’s Criminal Division head, Brian Benczkowski, took credit for the Ho sentencing (and may have had to approve the meeting with Luft). So it seems likely even Bill Barr’s DOJ were fine with those two prongs of the Luft prosecution.

The Woolsey allegation, of course is a different matter.

So, too, might another one be.

Count 7 of his indictment charges Luft with violating sanctions against Iran. It starts, as such charges do, with an explanation of the IEEPA authorizing such sanctions, generally. It spends six paragraphs describing the sanctions regime against Iran. It spends eight paragraphs describing the charged conduct involving Iran. Then, before the two paragraphs charging Luft for evading Iran sections, his indictment includes this paragraph:

80. Several months later, on or about October 10, 2016, CC-2 emailed GAL LUFT, the defendant, that CC-2 had a Chinese client who needed Russian oil, which LUFT confirmed he could help provide: “I just got off the phone with Russia. They have this.” Forwarding this email to CC-1, LUFT wrote: “If [CC-2] really has this client we need to grab it. This is exactly what we need. . . . I can get any source on the planet.”

That’s not related to the current charges (though if Luft continued to pursue business with Russia, particularly after 2017 and 2022 sanctions, those might amount to IEEPA sanctions violations as well). But it suggests DOJ’s interest into Luft may extend beyond China.

Hunter Biden’s Uber Connection and the K Street Collision

On December 3, 2018, at least per emails in the MarcoPolo set at BidenLaptopEmails dot com, Hunter Biden accessed his Uber account by logging in using his phone, but logging in through what appears to be a Comcast connection in Newburyport, MA, where he was getting treatment from Dr. Keith Ablow.

I found this request as part of my effort to figure out which iCloud accounts were run by which devices during the period — roughly January 14 to February 15, 2019 — when his digital life was being taken over and packaged up as part of a huge political hit job to be used against his father the following year.

It was surprisingly common for Hunter Biden to access Uber by logging in using a browser from a Mac computer, not the phone app. I’m not an Uber user, but isn’t the point that the service relies on tracking you via your phone and its location data?

But when Hunter Biden logged into Uber using his phone, the normal way, he appears to have used his cell service. Again, the normal way.

But on December 3, 2018, Hunter Biden logged into Uber using some Comcast network — not his cell service — in Newburyport MA, in the town but not the exact location where Dr. Ablow’s practice was; this also appears to be a different location from where Hunter would stay in January, as well.

As I laid out in this post, there were several instances during the period where Hunter Biden appears to have been getting his digital life hacked where his communications didn’t connect, starting with an exchange in January 2019 that Keith Ablow facilitated, in Hunter’s first known email to the shrink. It was an exchange asking two doctors for assistance. Hunter asked at one point, “Guys are you getting my emails?,” and contrary to Ablow’s assurances, it appears they were not. If Hunter wasn’t accessing his cell service in this period, that might help to explain why he was sending messages that their recipients weren’t getting.

But this Comcast log-in to Uber is notable for several other reasons.

Around February 13, 2018, Hunter had added his rhbdc iCloud account — the account believed to be taken over a year later — to his Uber account; prior to that his account was exclusively registered to his rhb iCloud account — the account that would be exposed via an encrypted phone backup available through iTunes. For most of 2018, Hunter Biden’s Uber account was common to both of those iCloud accounts. Both emails would get a notice whenever he used the service.

On December 1, 2018, the password was changed, with notice to just the rhb account. There were a bunch of rides on December 3, paid by Venmo (Hunter’s Venmo had definitely been compromised earlier in 2018, but that’s for another post), the Uber receipts for which don’t appear to be in the MarcoPolo stash of emails. On December 3, the rhbdc account password was changed. There was one ride on the rhbdc Uber on December 3 in Newburyport, the same location where the password had been changed.

But from December 3, 2018 through at least February 8, at least per the emails that ended up in the MarcoPolo set, just his rhbdc iCloud account was getting notices from Uber. The first trip showing that Uber had been set back to the way it had been was on February 19, 2019. Then, in the very last days of this email set, following new devices being added to Hunter’s Uber account, three or even four receipts show up.

Some of the rides during this period are pretty interesting, too — such as a 50-minute, 15-mile drive (with no wait time) to go .1 mile around the corner on a key day of the account takeover.

And while it doesn’t show up in the emails, per Gus Dimitrelos — the forensics guy who did a long report for Washington Examiner — the iPhone XS that would be stored to iTunes (registered to the rhb iCloud) had an Uber account showing a modified date on November 22, 2018, a created date of January 22, 2019 — right in the thick of events, and an accessed date of February 3, 2019. I don’t believe those Uber events show up in the MarcoPolo set, even though the set includes emails from both the rhb and rhbdc iCloud accounts and so should reflect changes made on the rhb Uber account.

Among other things, by splitting these two Uber accounts, you might show “Hunter Biden” in two different places at one time. Imagine, for example, if the “other intelligence” the IRS used to justify obtaining the laptop from Mac Isaac was just one of two Uber accounts showing him to be in Delaware?

The possibility that a digital or even physical Hunter Biden was in two places at once in this period brings me to a story about Lyft.

In addition to Hunter’s failed attempt to email two doctors in early January 2019, this post describes a few other communication disconnects in this key period.

  • He failed to respond to Ablow’s practice manager when she tried to respond to his droidhunter88 account on January 15
  • On January 18, Ablow entirely rewrote a statement for Vanity Fair in such a way that Hunter’s attorney George Mesires — who appears to have passed it onto the magazine — would not have realized it

Metaphorically, at least, Hunter Biden was not publicly speaking for himself in this period.

But there’s one more potential communication disconnect from this period.

On January 24, 2019, an Ablow associate, Greg, had a meeting with Hunter Biden at which (per an email the associate wrote memorializing the meeting), it was decided that Greg would be Hunter’s “Chief of Staff.”

The email memorialization had a list of things Greg was going to do, including communication with two of Hunter’s kids and his lawyer.

And his father’s assistant.

Among the things on the list — right next to sky diving and flying lessons ASAP — was a note to talk to Katie Dodge: “ski’s and gear – need phone number and address to ship to.”

Katie Dodge was Hunter Biden’s long-time personal assistant, who already was doing the administrative things on this list, though not the flying lessons and sky diving. Dodge was doing those administrative things for income less than half of what Greg proposed he should be paid, to do what Dodge was already doing (again, less the flying lessons and sky diving).

On January 29, 2019, five days after this meeting at which Greg made himself Chief of Staff in charge of contacting Dodge about skis and boots — per SMS texts published by Dimitrelos — Dodge wrote Hunter and asked him about paying for his storage facility. At least per the published SMS texts, this was the first she had spoken to Hunter via SMS text since October 2018.

After an exchange about the storage facility, Hunter asked whether she could get his skis and boots and send them to him, “here,” by context, in MA.

Can you get my ski bag- and ski boots – from storage. Fed-ex can pick them up and deliver here or there’s another company that does that and I can get them if someone puts skis and boots where they can pick up.

She seemed surprised by the request, and asked if they had previously been at K Street. She agreed to go get the skis — but noted that would require paying the overdue storage bill — and asked where she should be overnighting them.

Also what resort do they need to go to? What are the dates?

Hunter had no idea where he’s going to be using these skis that he asked her to overnight to MA.

I have neither.

She appears to have sent them, because on February 8, 2019, she asked,

Did you receive your skis?

This SMS conversation — focused largely on paying bills — went on for almost two more weeks. Then, on February 20 (the day after Hunter’s Uber account was restored to the way it had been before December 3), in response to a question about a particular financial change he said he wanted to make, which they had already discussed on February 15, Dodge asked if he had made the call to make that happen.

He seems to have missed that instruction entirely — because of “limited access to communications on all forms.”

No didn’t ! I’ve got limited access to communications on all forms

Then — in what seems like a muddled voice-to-text transmission — he asked her about the skis that she appears to have retrieved from storage by February 8, as if he doesn’t know that.

Ivan you get the skis done I’ll send you a dress tomorrow

She already sent the skis somewhere, but he was offering to send her the address in MA “tomorrow,” so on February 21.

I’m interested in the skis and Dodge’s efforts to retrieve them from storage in the DC area and her follow-up about them on February 8 because one of the things in unallocated space that someone tried to delete — again, per Dimitrelos’s reports — were the February 7, 2019 texts and collision report from a Lyft driver who apologized to “Mr. Biden” for the collision they had had the previous evening, February 6, at roughly this ridiculous part of K Street in Washington DC.

Hunter Biden’s long-time assistant wrote him on February 8, asking if he got the skis she made significant efforts to send him from the DC area to MA a week earlier, with absolutely no awareness that Hunter — or someone presenting as Hunter Biden — was on K Street, side-swiping or getting side-swiped by a Lyft driver.

Now, certainly, it was possible that Hunter Biden drove from MA to DC to be present for a car accident on February 6, 2019. Maybe the trip — by whomever — served to pick up those skis.

But neither he nor his personal assistant seems to have had any clue that that had happened.

Update: After several tries, I’ve taken out errors regarding when the Uber for the XS was set up. Thanks to zscoreUSA for the persistence.

Related posts

The Laptop Everyone Knows as Hunter Biden’s Appears to Have Been Deleted Starting February 15, 2019: This post describes a number of the events that occurred in the key time period, and has a timeline that will have to suffice until I tidy up an updated one.

Gary Shapley and Hunter Biden’s Colleague Named “Z”: One thing that happened in the key period in 2019 is that Hunter Biden’s contacts were restored — which creates the possibility that the publicly released contacts reflect alterations.

Hunter Biden’s Matryoshka Cell Phone: How the IRS and Frothers Got Hunter’s Encrypted iPhone Content: The “laptop” as we know it appears to be the entire iCloud of one Hunter Biden account and a phone containing another iCloud account saved — during the period of compromise — to his iTunes account.

Keith Ablow’s Unallocated Space in Hunter Biden’s Memory: When Hunter Biden went to Newburyport, MA to get Ketamine treatment from Fox News personality Keith Ablow in early 2019, he had a series of communications failures that prevented him from speaking to others directly.

Keith Ablow’s Unallocated Space in Hunter Biden’s Memory

In the third part of Gus Dimitrelos’ report* on the laptop attributed to Hunter Biden, he examines what he could find in the unallocated space of the laptop — the place where deleted files go on computers until they eventually get written over. He does it, in laymen’s terms, to prove that there was someone at the keyboard of the laptop, deleting individual files by hand, which he claims (falsely) is proof that, “Robert Hunter Biden is in control of the MacBook Laptop.”

He shows remarkably little interest in what got deleted.

At least two of the files deleted from the laptop pertain to the therapist from whom the President’s son was getting Ketamine treatment during the period his digital life appears to have been taken over, Keith Ablow, and in whose office the DEA discovered different laptop owned by Hunter Biden in 2020.

According to two people familiar with the matter, a different Hunter Biden laptop landed in the custody of the DEA in February when they executed a search warrant on the Massachusetts office of a psychiatrist accused of professional misconduct. The psychiatrist has not been charged with a crime.

Hunter Biden was not a target of the search or the investigation, and his lawyer ultimately got his laptop back. It’s not clear why his computer was left in the doctor’s office.

Who is Keith Ablow?

One enduring mystery about the “Hunter Biden” “laptop” affair is why the son of a top Democrat ended up doing Ketamine therapy with a Fox personality just weeks short of allegations that the shrink had sexually harassed patients, an accusation that would lead to his suspension.

Ablow’s career on Fox extended back years by the time in 2018 when Hunter Biden got involved with him. He made obnoxious comments both about the Obamas and marriage equality and a ludicrous pitch in favor of Newt Gingrich. There’s no reason a Democrat should ever have trusted him.

And then, shortly after the time when Hunter Biden’s digital world appears to have been taken over by his droidhunter Gmail, several lawsuits accusing Ablow of sexual harassment went public.

The women allege that Dr. Keith Ablow, an author who was a contributor to Fox News network until 2017, abused his position while treating them for acute depression, leaving them unable to trust authority figures and plagued with feelings of shame and self-recrimination.

“He began to hit me when we engaged in sexual activities,” wrote one plaintiff, a New York woman, in a sworn affidavit filed with her lawsuit. “He would have me on my knees and begin to beat me with his hands on my breasts,” she wrote, “occasionally saying, ‘I own you,’ or ‘You are my slave.’”

The malpractice lawsuits, two of them filed on Thursday in Essex Superior Court and a third filed last year, paint a picture of a therapist who encouraged women to trust and rely on him, then coaxed them into humiliating sexual activities, often during treatment sessions for which they were charged. When the New York woman had trouble paying her therapy bills, she said, Ablow advised her to work as an escort or stripper because the work was lucrative.

The three lawsuits were settled. But as a result Ablow’s medical license was suspended. As noted above, for some reason the DEA searched his office a year later, where they found yet another Hunter Biden laptop left behind.

Update: Here’s a picture of Ablow speaking at a Trump rally in MA on March 4, 2017.


Deleting Ablow

In fact, the accusations against Ablow were one of two things that Dimitrelos found in the unallocated space of what would have been the laptop.

On February 25, 2019, Hunter Biden texted someone else a link to the BoGlo report on the accusations, which had been published four days earlier. “My psychiatrist,” Hunter Biden explained in a follow-up text. “I can’t catch a break,” he said in the third. If authentic, these texts appear to capture Hunter’s immediate response to the abuse allegations, and the four-day delay in his discovery of them.

That someone would delete those is interesting enough.

But I’m far more interested in the other file Dimitrelos found. It was a December 10, 2018 invoice, sent by iChat. It reflected the following psychotherapy sessions with Hunter, which were identified as “New Incident”:

  • November 10, 2018: 90 minutes
  • November 11, 2018: 90 minutes
  • November 12, 2018: 30 minutes
  • November 14, 2018: 60 minutes
  • November 14, 2018: 60 minutes
  • November 15, 2018: 60 minutes
  • November 16, 2018: 60 minutes

It was a three page invoice, but Dimitrelos only shows the first page, so there could be more sessions in the weeks between November 16 and December 10, 2018. All sessions were paid by credit card within days.

But even just that single page shows that Hunter was spending time with Ablow in the period when he obtained new devices — including the laptop believed to be the one that ended up in John Paul Mac Isaac’s shop.

It’s easy to see, then, how and when Ablow might have come into possession of a Hunter Biden laptop and Hunter Biden might have started using the new one that would end up becoming a big political hit job.

[Update: I corrected my timeline here. Hunter Biden started using the laptop believed to be the one brought to Mac Isaac’s shop in October, not November.]

Baystate or Bluewater

Dimitrelos says the invoice, “correlates [with] email communications with Keith Ablow and the Practice Manager.”

But the invoice doesn’t. It differs with the emails we see with Ablow and his practice manager, a woman named Tiffany Bartholemew, as they appear in the BidenLaptopEmails dot com collection, in at least one key respect. The bill is from “Bluestate Psychiatry.” But Bartholomew writes from “Bluewater Wellness.”

The discrepancy may arise from a difference in treatment: and therefore also payment schemes. Of the emails related to Ablow sent by Hunter, about a dozen had to do with accommodations, including:

  • Emails Bartholomew sent on December 4, 2018 (and so before the invoice) about payment for “this week” at Plum Island Rental
  • The confirmation for that reservation, sent the same date as the invoice, to the rhbdcicloud and cc’ed to Bartholomew, followed by one sent on January 3, not cc’ed to Bartholomew, providing instructions for getting in
  • An email sent on January 26 from the “manager of Dr. Ablow’s cottage”
  • Seven emails from a guy who seems to have made himself Hunter’s Chief of Staff at a meeting on January 24, all of which pertain in part or in whole to finding a new place in Newburyport, MA

Those were all sent to the rhbdcicloud. Another email from Bartholomew, sent to the same email, alerted Hunter to a rescheduled Yoga session while in Massachusetts.

There were several other more curious emails involving Bartholomew:

  • An email sent on January 5, 2019 to rhbdc at, seemingly asking Hunter for advice about how to deal with an insane temp leaving adverse reviews on Google
  • An MP4, dated January 8, 2019, titled Neverending story, sent first via Google Drive from a Gmail account, then forwarded the next day from her Ablew email account, both times to the rhbdcicloud

In this same period, Hunter paid someone with the last name Bartholomew but a different first name, via Venmo, for purchases at CVS, using his rhbrspdc account.

Guys are you getting my emails?

But several of the emails demonstrate Hunter’s communication woes during this period.

The very first email from Hunter Biden to Ablow in the Marco Polo set, sent on January 3, 2019, was misaddressed, and bounced. It was sent again, with the subject line “yyyy.”

While no body of that text appears in the Marco Polo set, Ablow responded to it, adding a third person, Rock, and asking for help getting a doctor to review Hunter’s daughter’s x-rays from a bad skiing accident.

Hunter responds, saying he is attaching the x-rays (and reply emails show jpg attachments):

I am attaching the X-rays and would so much appreciate your helopmputting [sic] them in the right hands.

Hunter and Ablow exchange two emails among themselves.

Then Ablow responds to his own email, which this time is marked [External], noting that “His [apparently meaning Hunter’s] email is screwed up,” and then saying he had texted Rock.

From: Keith Ablow <kablow[redacted]>
Sent: Thursday, January 3, 2019 11:40 AM
To: Positano [redacted]; rhbdcicloud
Subject: [EXTERNAL]Re: From Keith

CAUTION: External Email.

His email is screwed up

I texted you

The doctor responds — happy to help — and provides his contact. Ablow thanks him. Hunter responds to that, plaintively,

Guys are you getting my emails?

And though neither of the external interlocutors ever said a thing directly to Hunter, Ablow says, yes, suggesting they had gotten his emails, then instructs Hunter to contact the doctor and “send him the x-rays,” even though in the original email Hunter already sent 2 jpgs.

Hunter then tried to email the doctor directly, using the same email included in Ablow’s email (possibly even using the link from the doctor’s own email), and it bounces, “RecipientNotFound; Recipient not found by SMTP address lookup.”

At least based on the Marco Polo set, Hunter Biden didn’t send much between then and January 15 (though I may return to what he did send; he had important exchanges with his lawyer George Mesires).

Then he had another communication failure with Ablow’s team, though apparently of a different type.

On January 15, 2019 at 11:13AM, Hunter sent Ablow’s practice manager, Bartholomew. an email from his droidhunter account, asking “Schedule?” The email itself appears in the MarcoPolo collection, but any other body of the email is not preserved.

Bartholomew responded, on January 15 at 11:19PM, to the droidhunter account, describing his schedule for both “today” (seemingly meaning January 15) and “tomorrow,” his Ketamine treatment on January 16.

Then, just under 3.5 hours later, she sent that same email again, to both the droidhunter and rhbdcicloud with the message:

Below is the response I sent within minutes of receiving your email.

I called you this morning
Both Keith and I texted – I, multiple times, both on the group text and solo
I tried calling
I had Jodi text and call and you did not answer until 2pm

I texted you after sending the below email and mentioned adding yoga on for tomorrow – I did not receive a response and I will not waste people’s time booking them if you do not stay in touch

Bartholomew appears to have attributed this to Hunter’s mental struggles, and it may well have been (though it is notable since it is the sole exchange with her involving the droidhunter email).

The reason people love my Dad Chris iOS because he’s the son they hope to raise

The questions about whether Hunter was communicating externally — to say nothing of the effect of the Ketamine treatment, which by context would have been January 16 — makes me really uncomfortable with what happened with a statement Hunter Biden shared for this Vanity Fair story on whether Hunter’s problems were leading Joe to hesitate about running.

The exchange starts with Hunter forwarding an email he sent to Doug Brinkley on his rosemontseneca email to Ablow, using his rhbdcicloud email, with his long and very rough draft of a statement.

Ablow asks if he wants edits.

I could also make a few other edits, with humility. Would you like me to?

Hunter responds by saying it needs both edits and to be more concise. So Ablow promises to do it overnight.

I can make it all happen by 8 am.

Not to worry.

This is my thing.

Stay tuned.

As that exchange was happening, Hunter sent the statement to his lawyer, George Mesires, via his rhbdcme address. Mesires responded saying, “I can’t stop crying,” but providing no edits.

Hunter sends two snide comments to the journalist to his attorney George Mesires, from the rosemontseneca email, ccing Ablow.

Then ultimately he sends the statement as rewritten by Ablow to Mesires.

“FIXED A FEW OF MY TYPOS . . .” Hunter said of the statement substantially written by Ablow. Mesires would have no way of knowing that Ablow had made all the changes.

Vanity Fair removed one paragraph about Hunter’s own background as well as this significantly edited snide comment to him:

I hope that answers your question, Chris. I would ask this one of you: Are your talents best used as a tabloid journalist? If you were willing to endure more pain to make a more powerful contribution to our shared world, what would you do? What has stood in your way? My father would tell you this: Don’t let it. Reach deep down and deliver the gifts you were meant to give to others. And that’s the message Americans will see come to life in 2020.

At a time when Hunter Biden was in a communications vacuum, just days off a Ketamine treatment, and probably getting his life hacked irreparably, to become the non-stop political hit job of those trying to take down his father, Keith Ablow replaced Hunter’s statement with his own.

In the process Ablow replaced this fairly amazing paragraph about Joe Biden … [I’ve left all typos, including the charming, “iOS” instead of “is.”]

The reason people love my Dad Chris iOS because he’s the son they hope to raise he’s the parent they hope to be he’s the brother and friend we all look up to. They love him Chris because he is as real an American as they are and they all want to be. He’s not perfect’ he’s got a horrible temper, he spoils his grandkids, he loves my Mom almost too much and he still thinks he can still make me angrier than anyone on earth sometimes. There’s nobody I want to make more proud of me than my Dad and there’s no-one that I know can ever be more proud of me and my whole family. May Dad never has asked anyone of us to be less human he’s just taught us all what it means to be a good man in hard world. He taught me what his mom and dad taught him “Always remember no man is better than you and you are no better than you.”if er to break I m certain they would all say —no one will ever know you better than your brothers and your sisters you always take their side no matter how badly they screwed up. Every Biden kid knows there’s nothing that they could do to make anyone in this family to stop loving you. And finally always be kind to the people in pain (unless they hurt your grandmother your mom your aunt or your sister- then you’re free to beat the shit out of them if your sister hasn’t beat you to it.)

With this one:

I believe that my father has become an ongoing symbol of what it means to keep on fighting for what is good in oneself, in others and in our country. I can tell you that I wouldn’t be alive today, if my dad hadn’t kept fighting for me, too, through my darkest days. So the idea that tragedy or tough times or any number of trials would dissuade a Biden from serving his fellow man—whether a friend or a fellow citizen—could not be more misguided. My dad has proven, ag ain and again, that he is (as Teddy Roosevelt once said of himself) “as strong as a bull moose” and that America “can use [him] to the limit.”

There’s no sign Brinkley ever responded to Hunter’s email. Instead, Hunter sent him three emails — one, responding to an email Brinkley sent him in July 2018, saying,

Obviously I didn’t send that stream of conscience rant with personal attacks and 7000 grammatical spelling and plain unintelligible errors made tons of edits and cutout 80%.

A minute later he sent two more responding to the email he had actually sent Brinkley, quoting just the bolded part of this last line of his own second paragraph.

And its made us understand that the one thing that binds us all not just my family everyone you will ever meet is what it is to feel pain and how the even the smallest gesture of genuine kindness and love can make you hope for a better day.

That line about small gestures of kindness, like much else from Hunter’s own statement, had been removed.

It’s not yet clear what happened between Ablow and Hunter — or whether Ablow’s awareness of Hunter’s technical communication problems went further than that single email.

What is clear is that, in the process, Ablow managed to replace Hunter’s own, heartfelt words about his father and his own struggles.

* At least the first of Dimitrelos’ reports is on Scribe. He sent me copies, but would only permit me to repost them (which would take far more redactions) with some kind of indemnity for ongoing privacy violations. I instead reached out to Hunter Biden’s attorneys for permission to share it privately with some experts but have heard nothing.

Hunter Biden’s Matryoshka Cell Phone: How the IRS and Frothers Got Hunter’s Encrypted iPhone Content

Believe it or not, what sent me down the rabbit hole of Hunter Biden’s “laptop” was not the laptop itself.

It was a cell phone.

Or, more specifically, it was two details in purported IRS whistleblower Gary Shapley’s testimony. First, after introducing summaries from some Hunter Biden WhatsApp chats — summaries that, Abbe Lowell claimed, got the most basic details wrong — Shapley explained that the chats didn’t come from the laptop itself, they came from a warrant served on Apple for the iCloud backup to which they were saved.

Q Could you tell us about this document, what is it, and how was it obtained —

A Sure. So there was an electronic search warrant for iCloud backup, and these messages were in that backup and provided —

Q Okay.

A — from a third party, from iCloud.

This appears to be the search warrant return obtained — again, per Shapley’s testimony — in August 2020.

For example, in August 2020, we got the results back from an iCloud search warrant. Unlike the laptop, these came to the investigative team from a third-party record keeper and included a set of messages. The messages included material we clearly needed to follow up on.

Shapley’s disclosure that there were WhatsApp texts saved to iCloud stunned me. That’s because, for all the material produced from the laptop itself — which even frothers have treated as all the content in Hunter Biden’s iCloud account — I had never seen WhatsApp texts.

Plus, there’s a technical issue. WhatsApp texts, like Signal texts, don’t automatically back up to iCloud. If one really wants to use their end-to-end encryption to best advantage, one doesn’t store them in the cloud, because then the only easy way to get the texts would be directly from someone’s phone. These texts purported to involve a Chinese national (though, as noted, Lowell says that’s false) whose phone would presumably be inaccessible overseas. And at the time the IRS obtained these texts, Hunter Biden didn’t know about the investigation into himself. They hadn’t seized his phone.

For Shapley’s description to be true, then, Hunter Biden would have had to back up the texts to his iCloud. But if he had, they should have shown up on the laptop itself, right along with every other scrap of the President’s son’s private life.

There were crumbs of an explanation for this in Shapley’s notes from the October 22, 2020 meeting on the government’s treatment of the laptop attributed to Hunter Biden.

In the meeting, Whistleblower X — who by his own description saw things online that he hadn’t obtained via the laptop directly, even though DOJ warned the agents not to do that — kept prodding about whether the investigative team had been provided all the messages on the laptop.

29. SA [Whistblower X] asked if all information on the hard drive had been reviewed…the answer is that they did not look at all of that SA [Whistleblower X] questions if Dillon reviewed all iMessage’s that wore relevant and not privileged. They would find the answer.

As Shapley recorded, on February 27, 2020, the forensics people provided all messages from the hard drive of material John Paul Mac Isaac restored from the laptop.

30. 2/27/2020 DE3 with all messages from the hard drive were provided by computer forensics— via USB Drive

That production included iPad and MacBook messages, but no iPhone messages.

32. 227 Productions

DE3 USB containing exported messages (ipad and macbook messages) No iphone messages

They didn’t get messages off any iPhone until they found a password, conveniently written on a business card, and with that password, were able to get into encrypted iPhone content on the laptop.

Laptop — iphone messages were on the hard drive but encrypted they didn’t get those messages until they looked at laptop and found a business card with the password on it so they were able to get into the iphone messages [my emphasis]

This still didn’t answer my question — how was the IRS able to get WhatsApp texts from iCloud when they weren’t on the iCloud content that appears on the Hunter Biden laptop.

But a detail on the fourth of Guy Dimitrelos’ reports on Hunter Biden’s laptop may explain it.

In his first report, Dimitrelos explained that the 5 million artifacts found on the hard drive were connected to Hunter Biden’s iCloud account, which he says was tied to the email [email protected].

  1. The hard drive contained approximately 5,791,819 files and system artifacts and was connected to and authenticated on an Apple iCloud account of [email protected] which is owned by Robert Hunter Biden (RHB).


  1. Since this Apple MacBook Pro model was not released until 2017, all data prior to 2017 was stored (backed-up) to the [email protected] account and then downloaded to the MacBook Pro hard drive Downloads folder as illustrated in paragraph 30.

In his fourth report — basically 133 pages into his sequential reporting — Dimitrelos noted that Hunter Biden had another iCloud account, one tied to one of the emails he identified on page 4 of his report: [email protected].

In fact, at least according to the unreliable emails released at BidenLaptopEmails dot com (AKA MarcoPolo), that’s the account to which the laptop believed to be the one that ended up at Mac Isaac’s shop was registered to, not the [email protected] account.

At the Marco Polo site, there are 453 pages of emails from the [email protected] account (so around 22650). They include some of the most interesting in the collection, the ones directly with the Biden family and others indicating sensitive travel. There are 269 from the [email protected] account (so around 13,450) — but it’s the latter that seems to have been taken over in early 2019. I’ve described that the droidhunter88 gmail account effectively took over control of the iCloud account in that period (though I need to go back to the timeline and distinguish which events happened on one iCloud account and which on the other), and I think that’s right. But importantly, at times, the RosemontSeneca email is linked into it. That is, a RosemontSeneca email was used on both iCloud accounts.

As to the phone, Dimitrelos describes that he found a phone registered to the [email protected] account in an encrypted container in an iTunes backup.

I identified an encrypted container located within Apple’s MobileSync iTunes default backup folder.


I identified the iOS backup to be an iPhone with the phone number below and Apple id of

[email protected] which is one of Robert Hunter Biden’s iCloud accounts.

Part two of Dimitrelos’ report described finding passwords for the iTunes account in two places. First, a picture of a partly rumpled lined piece of paper stored in a Hidden Album. This picture included Amazon, WiFi, iTunes, GMail, and Apple ID passwords, all registered to a different Gmail account. And then, associated with an iPad registered to still a third iCloud account, registered to a Gmail account.

The latter shows that Hunter Biden’s iTunes password was changed on January 30, 2019, solidly in the middle of the period I’ve argued that his account was taken over by the DroidHunter gmail account.

And screencaps in parts two and four of Dimitrelos’ report show that both the iPad and the iPhone were backed up during this same period, on February 6, 2019. Someone changed the iTunes password, and backed up these two devices, where they were found on the laptop. All in this same period where Hunter Biden seems to have lost control over his laptop.

In part four of Dimitrelos’ report, he describes that there were, indeed, WhatsApp messages on the iPhone, registered to that entirely different iCloud account, seemingly backed up to iTunes on the [email protected] account.

I can’t be sure about this, because I’m not a forensics expert, both Shapley and Dimitrelos are deliberately unreliable narrators, and even they don’t have all the data to understand what went on here. But it appears that the reason why there were no WhatsApp texts on the laptop itself, which had all the content in the [email protected] iCloud account, is that they weren’t used by a device registered to the [email protected] iCloud account. They were used by a device registered to the [email protected] account, which was (as Shapley’s notes reflect) stored in encrypted fashion on the laptop.

There’s one more very important point about this.

The government had a warrant. If they really did find a business card (one not described anywhere I’ve seen in Dimitrelos’ report) with a password, they were able to get the encrypted content (though oftentimes prosecutors will recommend you go back and get a second warrant for that). From there, it seems, the IRS got another warrant for the other iCloud account, the [email protected] one. That’s how they got a legally sound copy of the WhatsApp texts in August 2020.

But for people like Rudy Giuliani or Garrett Ziegler or John Paul Mac Isaac, taking a laptop they purport to have been abandoned, and then using a password found on that laptop to access an encrypted container — especially one of a different iCloud account — is legally another level of conduct.

Update: I screwed up the number of emails; I’ve corrected that now.

Andrew DeFilippis Had a Role in the Prosecution of Gal Luft’s Co-Conspirator-1

James Comer plans to rely on Gal Luft’s testimony in his efforts to gin up conspiracy theories against Joe Biden, even in spite of the indictment against Luft DOJ obtained before James Comer started pursuing his conspiracy theories.

Andrew DeFilippis handled the classified evidence in the Patrick Ho case

Because of that, I want to flag a detail about the Patrick Ho case, the case out of which this one arose.

Ho is the person described as Co-Conspirator-1 in the Luft indictment.

Ho was sentenced on March 25, 2019 for bribing Chadian and Ugandan officials; the former scheme started in a suite in Trump Tower in 2014.

Through a connection, HO was introduced to Cheikh Gadio, the former Minister of Foreign Affairs of Senegal, who had a personal relationship with President Déby. HO and Gadio met at CEFC China’s suite at Trump World Tower in midtown Manhattan, where HO enlisted Gadio to assist CEFC China in obtaining access to President Déby.

Days after Ho was sentenced, the two lead prosecutors on that case, Catherine Ghosh and Daniel Richenthal, flew to Brussels to meet with Luft. As alleged in the indictment, Luft lied to those prosecutors and four FBI agents about both the arms deals and Chinese influence peddling for which he has since been charged.

64. On or about March 28, 2019, in the Southern District of New York, Belgium, and elsewhere outside of the jurisdiction of any particular State or district of the United States, GAL LUFT, the defendant, who is expected to be first brought to and arrested in the Southern District of New York, a matter within the jurisdiction of the executive branch of the Government of the United States, knowingly and willfully made a materially false, fictitious, and fraudulent statement and representation, to wit, LUFT falsely stated during an interview at the United States Embassy in Brussels, Belgium with federal law enforcement officers and prosecutors, in connection with an investigation being conducted in the Southern District of New York, that LUFT had not sought to engage in or profit from arms deals, and instead merely had been asked by an Israeli friend who dealt in arms to check arms prices so that the friend could use this information in bidding on deals, a request that LUFT said he fulfilled by having CC-1 check prices with CC-2 and then relay this information to LUFT–when in fact LUFT had actively worked to broker numerous illegal arms deals for profit involving multiple different countries, both in concert with CC-1 and directly himself, including as described in paragraphs Forty-Four through Fifty-Three above.


84. On or about March 29, 2019, in the Southern District of New York, Belgium, and elsewhere outside of the jurisdiction of any particular State or district of the United States, GAL LUFT, defendant, who is expected to be first brought to and arrested in the Southern District of New York, in a matter within the jurisdiction of the executive branch the Government of the United States, knowingly and willfully made a materially false, fictitious, and fraudulent statement and representation, to wit, LUFT falsely stated during an interview at the United States Embassy in Brussels, Belgium with federal law enforcement officers and prosecutors, in connection with an investigation being conducted in the Southern District of New York, that LUFT had tried to prevent CEFC China from doing an oil deal with Iran, that LUFT had been excluded from CEFC China meetings with Iranians, and that LUFT did not know of any CEFC China dealings with Iran while he was affiliated with the company–when in fact, including as described above in paragraphs Sixty-Six through Eighty, LUFT personally attended at least one meeting between CEFC China and Iranians and assisted in setting up additional such meetings for the purpose of arranging deals for Iranian oil, and also worked to find a buyer of Iranian oil while concealing its origin.

Starting in early 2018, DeFilippis handled the classified evidence on the Ho case — both CIPA and a FISA order. He would have spent a great deal of time reviewing what the spooks had obtained on Ho and his associates, undoubtedly including Luft.

Andrew DeFilippis investigated John Kerry for a year

DeFilippis’ efforts on the Ho case took place in parallel with his efforts to gin up a criminal investigation against John Kerry. Here’s how Geoffrey Berman described being ordered to do that by Main Justice.

On May 9, the day after the second Trump tweet, the co-chiefs of SDNY’s national security unit, Ferrara and Graff, had a meeting at Main Justice with the head of the unit that oversees counterintelligence cases at DOJ, which is under the National Security Division.

He said that Main Justice was referring an investigation to us that concerned Kerry’s Iran-related conduct. The conduct that had annoyed the president was now a priority of the Department of Justice. The focus was to be on potential violations of the Logan Act.


From the outset, I was skeptical that there was a case to be made. I knew enough about the Logan Act to have strong doubts. Politicians from both sides of the aisle have talked about it from time to time, suggesting that some opponent is in violation of it. It never goes anywhere.

But I figured if they bring us a possible case, we’ll do our best. We’ll look into it. We brought a prosecutor from the national security unit, Andrew DeFilippis, into the investigation.

Trump, meanwhile, kept on tweeting. “John Kerry had illegal meetings with the very hostile Iranian Regime, which can only serve to undercut our great work to the detriment of the American people,” he wrote that September. “He told them to wait out the Trump Administration! Was he registered under the Foreign Agents Registration Act? BAD!”

DeFilippis’ efforts extended into 2019, overlapping with the trial of Ho and the interview with Luft. National Security prosecutors at Main Justice kept pressuring SDNY to advance the investigation into Kerry, but first, Berman had DeFilippis research whether the Logan Act would be chargeable even if Kerry had committed it.

The next step would have been to conduct an inquiry into Kerry’s electronic communications, what’s known as a 2703(d) order. That would have produced the header information—the to, from, date, and subject fields—but not the contents. I decided that before moving forward, it made sense to evaluate whether we would ever have a viable, appropriate charge that matched up with Kerry’s alleged conduct.

At the risk of stating the obvious, under our system of law, pissing off the president is not a chargeable offense. I asked DeFilippis to conduct additional legal research into the Logan Act and other potentially applicable theories. “Look, we’re talking about going to the next step here,” I said.

“But before we do any further investigation, I want to know what the law is on the Logan Act. Let’s say we gather additional documents—I want to know, how is that helping us?”

I wanted to answer the question, even if these things happened, was it a crime? Let’s cut to the chase and find that out, because we’ve got plenty of other work to do and I don’t want us to just be spinning our wheels on this.

For the next several months, DeFilippis conducted extensive research into the Logan Act as well as statutes relating to possible criminal ethics violations by former senior government employees.

On April 22, 2019, Trump tweeted, “Iran is being given VERY BAD advice by @JohnKerry and people who helped him lead the U.S. into the very bad Iran Nuclear Deal. Big violation of Logan Act?”

The tweet was in the morning. That afternoon, Ferrara got a call from Main Justice. He was told that David Burns, the principal deputy assistant attorney general for national security, wanted to know why we were delaying. Why had we not proceeded with a 2703(d) order—the look into Kerry’s electronic communications?

The next day, Burns spoke to Ferrara, Graff, and DeFilippis and repeatedly pressed them about why they had not submitted the 2703(d) order. The team responded that additional analysis needed to be done before pursuing the order.

SDNY decided not to pursue the case against Kerry in fall of 2019.

We spent roughly a year exploring whether there was any basis to further investigate Kerry. Memos were written, revised, and thoroughly discussed.

Our deep dive into the Logan Act confirmed why no one has ever been successfully prosecuted under it in the more than 220 years it has been on the books: the law is not useful. It definitely does not prohibit a former US secretary of state from talking to a foreign official. We did not find that Kerry violated any ethics statutes or any laws having to do with the improper handling of classified material.

In September 2019, DeFilippis advised the National Security Division at Main Justice that we would not be pursuing the case further. He had earlier attempted to tell the specific NSD attorney assigned to the case of our decision, but he couldn’t connect because that attorney was engaged in another matter: the Craig trial.

Sometime after that, DeFilippis became the lead prosecutor on the Durham team, leading the prosecution of Michael Sussmann.

Andrew DeFilippis oversaw the most abusive parts of the John Durham prosecution

Over the course of the Michael Sussmann prosecution, DeFilippis and his prosecution team:

As noted above, Geoffrey Berman boasted that the investigation into Kerry didn’t leak. Even ignoring the inexplicably perfect concert between Alfa Bank’s efforts and Durham’s, it’s not clear the same can be said about the Durham investigation.

And it’s not just that DeFilippis routinely tried to introduce evidence that served his narrative rather than matched the facts. It’s that DeFilippis repeatedly — most notably in the alleged complaint that researchers working on a DARPA project would attempt to identify which Russians were interfering in the US election — proved more sympathetic of Russian efforts to help get Trump elected than to conduct an ethical prosecution.

Last August, shortly before Durham confessed the utter humiliation of his team at the hand of Sergei Millian, DeFilippis withdrew from the Durham team with almost no notice, left DOJ, and returned — in a Special Counsel role, not as Partner — to Sullivan & Cromwell.

These are just data points. There is no reason, yet, to believe that DeFilippis continues to unethically gin up conspiracy theories against Democrats.

But they are data points I thought worth collecting in one place.

The Blind Squirrel’s Nut: Chuck Grassley Unwittingly Debunks Bill Barr

Last month, Bill Barr got Federalist Faceplant Margot Cleveland to claim that Jamie Raskin was lying when he said that the lead from an informant claiming that Joe Biden had been bribed was assessed by Pittsburgh US Attorney Scott Brady and then shut down.

It’s not true. It wasn’t closed down,” William Barr told The Federalist on Tuesday in response to Democrat Rep. Jamie Raskin’s claim that the former attorney general and his “handpicked prosecutor” had ended an investigation into a confidential human source’s allegation that Joe Biden had agreed to a $5 million bribe. “On the contrary,” Barr stressed, “it was sent to Delaware for further investigation.”

Then James Comer relied on that to claim that Raskin was wrong when he said that it was shut down as an assessment.

Bill Barr to Margot Cleveland to James Comer: At each new level, this Matryoshka doll of disinformation gets less and less credible.

So incredible, in fact, that even Chuck Grassley debunked them.


Like the proverbial blind squirrel finding a nut.

You see, Chuck is outraged that the IRS agents conducting the investigation into Hunter Biden’s alleged tax crimes were not included in a meeting at which Pittsburgh FBI agents briefed the Delaware US Attorney’s office about the informant report. He has written Delaware US Attorney David Weiss a letter demanding an explanation of why.

The answer is clear from the timing of the briefing, which Senator Grassley reveals in his letter: October 23, 2020.

Based on information provided to my office from individuals aware of the meeting, on October 23, 2020, Justice Department and FBI Special Agents from the Pittsburgh Field Office briefed Assistant U.S. Attorney Lesley Wolf, one of your top prosecutors, and FBI Special Agents from the Baltimore Field Office with respect to the contents of the FBI-generated FD1023 alleging a criminal bribery scheme involving then-Vice President Biden and Hunter Biden; however, the meeting did not include any IRS agents. In addition, based on information provided to my office, potentially hundreds of Justice Department and FBI officials have had access to the FD-1023 at issue, which begs the question that I’ve been asking since the start of my oversight in this matter: what steps have the Justice Department and FBI taken to investigate the allegations?

This briefing was nine days after a NYPost story would have made clear that Rudy Giuliani had ties to the “Hunter Biden” “laptop” that the IRS agents had been relying on for investigative materials for the better part of a year.

It was one day after an October 22, 2020 meeting that the IRS agents did attend. As Gary Shapley confessed to the House Ways and Means Committee, the meeting was largely an effort to make sure that the government had used proper legal process before acquiring two devices that — it had only recently became clear — had become and may always have been part of a political hit job.

A Yes. So there are a couple significant parts of this. One was that, at this time, the laptop was a very big story, so we were just making sure that everything was being handled appropriately.

So we wanted to go through the timeline of what happened with the laptop and devices. I thought one of the most important first parts was that on November 6 of 2019, the FBI case agent, Josh Wilson, called up the computer shop owner, John Paul, and basically got the device numbers from him.

If Shapley’s notes are at all reliable, prosecutors at the meeting instead discovered that the FBI broke the most basic rules of forensics when exploiting the laptop purportedly owned by the former Vice President’s dissolute son, and in the process may have destroyed evidence about who was really behind it. I’m still not convinced his notes are reliable, but if they are, then the meeting should have raised all sorts of alarms within DOJ.

As I laid out here, Shapley has instead pitched the meeting as one that served the primary purpose of giving Whistleblower X opportunity to complain that the US Attorney’s office had prevented the IRS agents from being tainted by dodgy materials on the laptop. Whistleblower X did complain, mind you, but those complaints mostly raise questions about the extent to which he had already been accessing materials from the laptop that Rudy Giuliani had been tampering with, thereby tainting the investigation.

Shapley’s propaganda has worked, because that’s what our blind squirrel from Iowa focuses his letter on.

But as Shapley described in his prepared statement, even before that meeting he had written to AUSA Lesley Wolf complaining about how the laptop was being referred to in the news.

On October 19th, 2020, I emailed Assistant United States Attorney Wolf: “We
need to talk about the computer. It appears the FBI is making certain representations
about the device, and the only reason we know what is on the device is because of the
IRS CI affiant search warrant that allowed access to the documents. If Durham also
executed a search warrant on a device, we need to know so that my leadership is
informed. My management has to be looped into whatever the FBI is doing with the
laptop. It is IRS CI’s responsibility to know what is happening. Let me know when I can
be briefed on this issue.”

Shapley appears to have been concerned, in the weeks before the Presidential election, that people believed the laptop was being investigated by the FBI as an information operation targeting Joe Biden, when in his view, it remained the cornerstone of his investigation into Hunter Biden.

But if DOJ was not already investigating both topics by October 23, 2020 — both Hunter Biden’s tax crimes and a potential information operation targeting Joe Biden — if it has not spent years doing so, then the FBI has become even more captured than I already suspected.

Indeed, if the FBI hasn’t already significantly substantiated that Hunter Biden was hacked in early 2019, then I may renounce my citizenship. I know FBI’s cyber agents can be incompetent, but they can’t be that incompetent, can they?

Can they?

Chuck Grassley may not realize it because he is very old and he is staffed by a bunch of partisan cranks. But he’s basically complaining that DOJ might have learned their lesson after the Steele dossier — the lesson that Chuck Grassley spent years demanding they learn! — and decided, upon the revelation that a key piece of evidence they had been relying on for months had ties to a political hit job, they should figure out precisely what tie that key piece of evidence had to the political hit job.

Chuck Grassley may also not realize that the political cranks who staff him got him to sign a letter effectively complaining that the FBI thought it worthwhile to figure out if the information operation Russian spies had been bragging about for over a year at that point had actually succeeded. Chuck is bitching that the FBI decided to protect a presidential candidate.

Chuck Grassley also likely doesn’t realize his staffers got him to sign a letter bitching that David Weiss attempted to maintain the integrity of the tax investigation even while DOJ assessed whether they had been caught in another information operation. That’s why you don’t include the IRS agents in a meeting where Pittsburgh FBI agents explain to Delaware lawyers how sketchy was the information Rudy Giuliani was collecting from known Russian agents in Ukraine. If you include them, you risk blowing the otherwise meritorious tax investigation.

And Chuck Grassley definitely doesn’t realize that he has debunked Bill Barr.

You see, Bill Barr, who is a very adept liar, was sort of telling the truth to Faceplant Margot that the FD-1023 was referred to DE USAO for further investigation. It surely was. But Pittsburgh FBI agents shared it on October 23, 2020, because the US Attorney’s office was frantically trying to figure out whether the entire tax investigation had been blown, or only parts of it. The US Attorney’s office was undoubtedly trying to understand what kind of other garbage Rudy had produced that got shared with the FBI, in addition to any role he had with the “laptop” that had been used in the tax investigation.

Even Gary Shapley admitted that in the wake of the NYPost story, the Delaware US Attorney’s office did some quick CYA to figure out whether they had been using a tainted information operation for the better part of a year (they had!). The October 23 briefing would have had substantially the same purpose as the October 22 one: to figure out how tainted the investigation was.

And Bill Barr instead got even stupider people to believe that that an attempt to triage the damage done by Rudy’s political hit job amounts to an investigation for bribery.

Gary Shapley and Hunter Biden’s Colleague Named “Z”

There was a detail in Abbe Lowell’s letter to House Ways and Means Chair Jason Smith complaining about the way Smith platformed purported whistleblowers to launch an attack on Joe Biden that deserves more attention: Lowell claimed that Gary Shapley misrepresented the identity of the person with whom Hunter Biden had a WhatsApp exchange in 2017.

This is the WhatsApp exchange that Smith mocked up to look like texts themselves. The mocked up texts went wildly viral based on Smith’s unsubstantiated claim that Joe Biden was in the room with Hunter during his deal-making.

Lowell described that fake mock-up this way.

The agent only described one message, but you took that purported text and disseminated images of it on June 22 and June 24 in two Twitter postings.

The screen-grab images you posted are not real and contain myriad of issues: both include a photo of Mr. Biden not from 2017 but from the White House Easter Eggroll in April 2022 (long after the purported message was sent); both images portray the message in a blue bubble, when WhatsApp messages are in green; one image super-imposed the Chinese flag for the contact ID, when surely that was not how a text or contact was kept; and one purports to be a screenshot with the “. . .” of someone composing a text (as in Apple’s iMessage) when that does not happen on WhatsApp.

I explained why Smith had to attempt to recreate WhatsApp messages in this post: Shapley himself shared summaries of the purported WhatsApp messages, rather than the WhatsApp messages themselves or the forensic report from Apple whence (Shapley claimed) the IRS obtained them.

Not only did Shapley admit to the Committee they were summaries, but Shapley isn’t even sure who did the summary.

Q Could you tell us about this document, what is it, and how was it obtained —

A Sure. So there was an electronic search warrant for iCloud backup, and these messages were in that backup and provided —

Q Okay.

A — from a third party, from iCloud.

Q Okay. Who was it provided to?

A The — the investigative team from —

Q Okay. A It would go through all the same processes of — since it’s electronic, it would go to one of the computer analysis folks, and then they would put it in a readable format, and then it would go through filter review.

Q Okay. And these aren’t WhatsApp messages, these are summaries of WhatsApp messages, correct?

A Yeah, that’s correct. Because it was something about the readability of the actual piece, right? It was easier to summarize in a spreadsheet.

Q Okay. And who did the summary? Who prepared this document?

A It was either the computer analysis guy or [redacted, probably Whistleblower X], one or the other [my emphasis]

Even on their face, they’re not reliable summaries. In this text, for example, someone interjects their opinion, “believed to be Zhao” right into the middle of a purported quotation, without marking that opinion as such.

Given that the summary presents at least this direct quote with additional information, we can’t be sure whether other quotes — particularly references to Zhao — are accurate.

Compare Shapley’s summaries with what reliable law enforcement summaries of WhatsApp chats saved to iCloud and obtained from Apple look like (this was an exhibit in the Vladimir Klyushin trial and would have been obtained in the same timeframe).

Not only does this directly quote all the messages, but it includes exact time and the accounts used, details that should drive any law enforcement investigation.

The summary matters, a lot. That’s because Lowell claims that Shapley — or whoever did these summaries — misidentified the Hunter Biden interlocutor whose last name begins with Z.

In one excerpt that has now gotten a great deal of media attention, Mr. Biden is alleged to have been sitting next to his father on July 30, 2017, when he allegedly sent a WhatsApp message, urging the completion of some business transaction. See Shapley Tr. at 14. The inference is that the referenced message was being sent to an official of CEFC (China Energy) to forward a false narrative about the Bidens’ involvement in that company. The facts, which some media has now reported, are that President Biden and our client were not together that day, the company being referenced was not CEFC but Harvest Financial Group (with a person who also had the initial “Z”), and that no transaction actually occurred. More important, your own actions call into question the authenticity of that communication and your subsequent use of it. In short, the images you circulated online are complete fakes. Many media articles confirm that data purported to have come from Mr. Biden’s devices has been altered or manipulated. You, or someone else, did that again. All of the misstatements about this communication and your use of a false text are good examples of how providing one-sided, untested, and slanted information leads to improper conclusions. [my emphasis]

This is a remarkable claim, because — if true — it suggests the IRS was investigating Hunter Biden based on wildly incorrect assumptions about the identity of his interlocutors.

Abbe Lowell claims that the IRS agents who investigated his client for five years — the son of the President!!! — didn’t know to whom he was talking! I’ve heard a lot of outlandish claims from defense attorneys (though Lowell is far more credible than the grifters who defend a lot of January 6 defendants), But this is an utterly inflammatory claim.

Had Shapley used responsible summaries, rather than the unprofessional script he did use, it might be possible to figure out who is right, here, because then we could compare the actual number or email account used.

Or maybe not.

There’s another possible way to explain why IRS agents wouldn’t even know the identity of the person with whom Hunter Biden was discussing business deals.

One of the things that happened during January 2019 when Hunter Biden’s droidhunter88 account had taken over his iCloud account is that his contacts list was “restored.”

In the publicly released emails, there’s no indication of when the request was made, or restored from what. But it happened around the same time as “Hunter Biden” requested a full iCloud download, including his contacts list.

That iCloud download is almost certainly what became much of the content on what is now known as the “Hunter Biden” “laptop” — a laptop the IRS was using (after booting it up in a new laptop, if you can believe Shapley’s notes) for evidence in this investigation.

There are at least three possibilities here:

  • Shapley is right and Abbe Lowell is wrong
  • Whoever wrote these unprofessional summaries just guessed — wrongly — who Hunter’s interlocutor was
  • The iCloud contacts list that the IRS was using when these summaries were made had been altered

We don’t have enough data to know. But given what even Hunter Biden’s persecutors have released, we can’t rule out the last one — that the IRS was using a doctored contacts list to investigate Joe Biden’s son.

The Laptop Everyone Knows as Hunter Biden’s Appears to Have Been Deleted Starting February 15, 2019

I’ve been wading through Hunter Biden data all weekend. There’s some evidence that the descriptions of the “Hunter Biden” “laptop” based on the drive Rudy Giuliani has peddled do not match the description of what should be on such devices given what the FBI and IRS saw.

Before I explain that, though, I want to talk about how the life of Hunter Biden’s iCloud account differs from what is portrayed in this analysis paid for by Washington Examiner.

As that report describes, Hunter Biden activated a MacBook Pro on October 21, 2018, then set it up with Hunter’s iCloud on October 22. Hunter then used the MacBook as his primary device until March 17, 2019, a month before it waltzed into John Paul Mac Isaac’s computer repair shop to start a second act as the biggest political hit job ever.

There are problems with that story. A longer table of the devices that logged into Hunter Biden’s iCloud includes devices that appear to have been accessing core Hunter Biden content.

That same table doesn’t show any access after November 15, 2018, with the last access being the device Roberts MacBook Pro that would end up in a Delaware repair shop, but showing up six days earlier than it should. There’s a phone that should but does not show up in those devices, too.

The report doesn’t discuss the import of the shifts between these emails.

RHB used several emails for business and personal use including:
[email protected] [sic]
[email protected] ([email protected])
[email protected]
[email protected]
[email protected]

One email missing from this list is a Gmail account under which a bunch of passwords were stored. That’ll become important later.

The most important email is the Gmail account (misspelled above), [email protected], which Hunter Biden used to contact sex workers, probably including the Russian escort service that the IRS used to predicate the IRS investigation. That email account got added to his iCloud account at the same time as his iCloud contents were requested, and then again before the MacBook stopped being used. Those changes often happened in conjunction with changes to the phone number.

For now, though, I just want to map out the major events with Hunter’s iCloud accounts from September 1, 2018 (perhaps the months before the IRS would open an investigation into him because he was frequenting a Russian escort service) until the final email as found on the laptop itself. There’s a bunch more — one after another credit card gets rejected, and he keeps moving his Wells Fargo card over to pay for his Apple account; the iCloud account shows Hunter reauthorizing use of biometrics to get into his Wells Fargo account in this period.

In January 2019, the Gmail account Hunter Biden used to contact sex workers (probably including the Russian escort service he had been using) effectively took over his iCloud account and asked for a complete copy of his iCloud account. Then, the next month, all the data on the Hunter Biden laptop was deleted.

Update: I’ve taken the reference to the HB RediPhone out altogether–it’s clear that’s a branded iPhone–and replaced it with a better explanation of the other devices.

Update: I see that he does have D[r]oidhunter88, but doesn’t discuss the import of it.

Update: I’ve added a few things that happened while Hunter’s account was pwned. Importantly, as part of this process an app called “Hunter” was given full access to his droidhunter88 gmail account. There are also a few emails that seem to be a test process.

Update: Added the missing Gmail account.

Hunter Biden’s iCloud

9/1/18: An account recovery request for your Apple ID ([email protected]) was made from the web near Los Angeles, CA on August 31, 2018 at 9:36:07 PM PDT. The contact phone number provided was [Hunter Biden’s].

9/1/18: The following changes to your Apple ID, [email protected] were made on September 1, 2018 at 10:29:36 AM PDT: Password

9/1/18: Your Apple ID ([email protected]) was used to sign in to iCloud on a MacBook Pro 13″.
Date and Time: September 1, 2018, 10:34 AM PDT

9/1/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser.
Date and Time: September 1, 2018, 10:42 AM PDT

9/2/18: Your Apple ID, [email protected], was just used to download Hide2Vault from the Mac App Store on a computer or device that has not previously been used.

9/2/18: Welcome to your new MacBook Pro with Touch Bar.

9/11/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser.

9/11/18: The password for your Apple ID ([email protected]) has been successfully reset.

9/11/18: Robert’s iPad is being erased. The erase of Robert’s iPad started at 2:56 PM PDT on August 5, 2018.

This is one of several times in several weeks that Hunter loses his iPhone, but while it’s lost, someone also pings his MacBook.

9/16/18: A sound was played on iPhone. A sound was played on iPhone at 8:25 PM PDT on September 15, 2018. (Repeats 25 times in 5 minutes)

9/16/18: A sound was played on Robert’s MacBook Pro at 8:30 PM PDT on September 15, 2018. (Repeats 2 times)

9/16/18: A sound was played on iPhone at 8:31 PM PDT on September 15, 2018. (Repeats 7 times)

9/16/18: iPhone was found near Santa Monica Mountains National Recreation Area 23287 Palm Canyon Ln Malibu, CA 90265 United States at 11:32 PM PDT.

9/16/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser.

9/19/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser.

9/20/18: Your Apple ID (r[email protected]) was used to sign in to iCloud on an iPhone 8 Plus.

This is the second time he loses his phone. What follows is basically a chase of Hunter Biden’s iPhone across LA. It’s not clear it is ever recovered — but it is over two weeks before a new iPhone logs into his account.

9/27/18: Lost Mode enabled on Robert Hunter’s iPhone. This device was put into Lost Mode at 7:20 PM PDT on September 27, 2018.

9/27/18: Robert Hunter’s iPhone was found near [address redacted] Lynwood, CA 90262 United States at 7:20 PM PDT.

9/27/18: Your Apple ID (r[email protected]) was used to sign in to iCloud on an iPhone 8 Plus.

9/27/18: A sound was played on Robert Hunter’s iPhone at 7:20 PM PDT on September 27, 2018.

9/27/18: A sound was played on Robert Hunter’s iPhone at 7:20 PM PDT on September 27, 2018.

9/27/18: Robert Hunter’s iPhone was found near [address redacted] Lynwood, CA 90262 United States at 7:20 PM PDT.

9/28/18: Robert Hunter’s iPhone was found near [different address redacted] Lynwood, CA 90262 United States at 4:24 PM PDT.

9/28/18: Robert Hunter’s iPhone was found near [third address redacted] Lynwood, CA 90262 United States at 5:27 PM PDT.

9/28/18: Robert Hunter’s iPhone was found near [fourth address redacted] Los Angeles, CA 90036 United States at 6:22 PM PDT.

9/28/18: Robert Hunter’s iPhone was found near [fifth address redacted] Los Angeles, CA 90069 United States at 6:38 PM PDT.

10/13/18: Bobby Hernandez to [email protected]: You left your phone. How do I get it to you?

10/14/18: The password for your Apple ID ([email protected]) has been successfully reset.

By date, this login is the HB rediPhone, but Apple recognized it as an iPhone X.

10/14/18: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone X. Date and Time: October 14, 2018, 11:24 AM PDT

10/17/18: The password for your Apple ID ([email protected]) has been successfully reset.

10/17/18: The following information for your Apple ID (r••••• was updated on October 17, 2018. Trusted Phone Number Added – Phone number ending in 73

10/17/18: New sign-in to your linked account [email protected] Your Google Account was just signed in to from a new Apple iPhone device.

Per the Gus Dimitrelos report, the following activity reflects the creation of a new MacBook account called Robert’s MacBook Pro — the laptop that would end up in Mac Isaac’s shop. But there doesn’t appear to be an alert for a new device like there is the for the iPhone 8 Plus the following day.

10/21/18: Your Apple ID ([email protected]) was used to sign in to iCloud on a MacBook Pro 13″. Date and Time: October 21, 2018, 5:50 AM PDT

10/21/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: October 21, 2018, 9:06 AM PDT

10/22/18: The following changes to your Apple ID, [email protected] were made on October 22, 2018 at 7:47:30 PM EDT: Phone number(s)

10/23/18: Your Apple ID, [email protected], was just used to download Quora from the App Store on a computer or device that has not previously been used.

10/23/18: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone 8 Plus. Date and Time: October 23, 2018, 4:10 PM PDT

10/23/18: New sign-in to your linked account [email protected] Your Google Account was just signed in to from a new Apple iPhone device.

Several spyware apps get purchased in this period.

10/29/18: Your mSpy credentials to your control panel: Username/Login: [email protected]

11/2/18: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone XS.

11/16/18: You recently added [email protected] as a new alternate email address for your Apple ID.

11/21/18: You’ve purchased the following subscription with a 1‑month free trial: Subscription Tile Premium

11/22/18: Your Apple ID, [email protected], was just used to download KAYAK Flights, Hotels & Cars from the iTunes Store on a computer or device that has not previously been used.

12/28/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: December 28, 2018, 7:06 AM PST

1/3/19: Keith Ablow (then Hunter’s therapist) says Hunter’s email is screwed up

1/6/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: January 6, 2019, 1:51 AM PST

1/12/19: Your Recent Mac Cleanup Pro Order [ADV181229-7742-90963]

1/14/19: The following changes to your Apple ID, [email protected] were made on January 13, 2019 at 10:28:31 PM EST: Phone number(s)

1/14/19: The following changes to your Apple ID, [email protected] were made on January 13, 2019 at 10:31:15 PM EST: Password

1/14/19 The following changes to your Apple ID, [email protected] were made on January 13, 2019 at 10:52:13 PM EST: Billing and/or Shipping Information

1/14/19: The following changes to your Apple ID, [email protected] were made on January 13, 2019 at 10:53:40 PM EST: Phone number(s)

1/14/19: The following changes to your Apple ID, [email protected] were made on January 13, 2019 at 11:12:45 PM EST: Billing Information

1/16/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: January 16, 2019, 1:59 PM PST

While Hunter is in Ketamine treatment at Keith Ablow’s, a service called “Hunter” gets access to the droidhunter88 gmail account

1/16/19: Here’s my first tip for you!

1/16/19: Hi Robinson, Hunter now has access to your Google Account [email protected].

Hunter can:
View your email messages and settings
Manage drafts and send emails
Send email on your behalf

A bunch of things happen in this four day period: first, someone accessed droidhunter88 from a new iPhone. Someone changed the phone number for the Hunter Biden iCloud. Then, droidhunter88 was given access to the iCloud account. Then the iCloud account ordered all of Hunter’s iCloud contents. Then the password for the account was reset.

1/17/19: New device signed in to [email protected] Your Google Account was just signed in to from a new Apple iPhone device.

1/17/19: I am here to help you find the emails you need!

Giovanni here from Hunter.

I wanted to quickly check if I can help you getting started with Hunter.

There are plenty of functionalities included with your free plan that will allow you to find, verify and enrich a set of data in bulk: these are all explained in our video guides.

However, if you already have a precise task to perform, reply to this email so I can better assist you!

1/17/19: n (from [email protected])

1/18/19: Long email to tabloid journalist sent under rosemontseneca email (this is sent first to Keith Ablow and then George Mesires, the latter of whom responds); this would have shown how the email account worked

1/19/19: The following information for your Apple ID (r••••• was updated on January 19, 2019. Trusted Phone Number Removed – Phone number ending in 13

1/20/19: The following changes to your Apple ID, [email protected] were made on January 20, 2019 at 5:24:54 PM EST: Phone number(s)

1/20/19: The following changes to your Apple ID, [email protected] were made on January 20, 2019 at 5:31:21 PM EST: Apple ID
Email address(es)

1/20/19: The following changes to your Apple ID, [email protected] were made on January 20, 2019 at 5:31:21 PM EST: Apple ID Email address(es)

1/20/19: A request for a copy of the data associated with the Apple ID [email protected] was made on January 20, 2019 at 5:40:26 PM EST

1/21/19: The password for your Apple ID ([email protected]) has been successfully reset.

1/21/19: The following changes to your Apple ID, [email protected] were made on January 21, 2019 at 8:28:05 AM EST: Name — changed from Robert Hunter to Robert Biden

1/21/19: You recently added droidhunter[email protected] as the notification email address for your Apple ID

1/21/19: The following changes to your Apple ID, r[email protected] were made on January 21, 2019 at 8:31:02 AM EST:
Rescue email address

1/22/19: The following information for your Apple ID (r••••• was updated on January 22, 2019. Trusted Phone Number Removed – Phone number ending in 96

1/22/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: January 22, 2019, 4:21 AM PST

1/22/19: The following changes to your Apple ID, rh[email protected] were made on January 22, 2019 at 10:05:20 AM EST:
Email address(es)

1/22/19: The following changes to your Apple ID, rh[email protected] were made on January 22, 2019 at 10:05:29 AM EST:
Email address(es)

1/22/19: The following changes to your Apple ID, rh[email protected] were made on January 22, 2019 at 10:05:34 AM EST:
Email address(es)

1/24/19: You recently added r[email protected] as a new alternate email address for your Apple ID.

I think that after ordering all Hunter’s data, the account is reset to what it had been from the start. But Droidhunter88, not [email protected], gets the iCloud backup.

1/24/19: Your contacts have been restored successfully on January 24, 2019, 1:17 PM PST.

1/25/19: The data you requested on January 20, 2019 at 5:40:26 PM EST is ready to download. [Sent to both Droidhunter88 and [email protected]]

1/27/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: January 27, 2019, 7:41 AM PST

Several photo editing apps are purchased in this period (and one CAD app).

1/27/19: You’ve purchased the following subscription with a 1‑month free trial: Subscription Polarr Photo Editor Yearly

2/6/19: The following changes to your Apple ID, [email protected] were made on February 5, 2019 at 11:39:09 PM EST: Phone number(s)

2/9/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: February 9, 2019, 9:52 AM PST

2/9/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: February 9, 2019, 5:08 PM PST

Hunter connected to your Google Account
Hi Robinson,

2/9/19: Hunter now has access to your Google Account [email protected].

2/9/19: test To:[email protected]

2/9/19: jkFrom:”Robinson Hunter” [email protected]:[email protected]

2/9/19: The following information for your Apple ID (r••••• was updated on February 10, 2019. Trusted Phone Number Added – Phone number ending in 96

2/9/19: You recently added r[email protected] as the notification email address for your Apple ID.

2/9/19: You recently added [email protected] as the notification email address for your Apple ID

2/9/19: The following changes to your Apple ID, [email protected] were made on February 9, 2019 at 8:33:57 PM EST: Rescue email address

2/9/19: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone 6s. Date and Time: February 9, 2019, 6:11 PM PST

2/10/19: Your Apple ID, [email protected], was just used to download Call recorder for iphone from the iTunes Store on a computer or device that has not previously been used.

2/15/19: Hi Robinson, Did you know? Hunter doesn’t have only one Chrome extension! We recently built a simple email tracker for Gmail.

This is where the data on the MacBook that would end up in Mac Isaac’s shop started getting deleted.

2/15/19: Robert’s MacBook is being erased. The erase of Robert’s MacBook started at 4:18 PM PST on February 15, 2019.

2/15/19: Robert’s MacBook Pro has been locked. This Mac was locked at 8:36 PM PST on February 15, 2019.

2/19/19: Noiseless MacPhun LLC

2/20/19: where the fuck are youi? from DroidHunter88 to dpagano:

this is hunter
i dont have your #

call me please

The droidhunter88 account bought a new iPhone — but, after telling Apple they would recycle the old one, instead kept it. That would effectively be another device associated with Hunter Biden. Given some of the other apps involved, this may have served as a way to get Hunter Biden’s calls (eg, from Mac Isaac). Unlike the new devices that show up in 2018, this one was paid for. 

2/21/19: New device signed in to [email protected] Your Google Account was just signed in to from a new Apple iPhone device.

2/21/19: Hi Robinson, Welcome to Google on your new Apple iPhone (tied to droidhunter88)

2/28/19: Your items are ready for pickup.Order Number: W776795632Ordered on: February 28, 2019

2/28/19: Your trade-in has been initiated. Thanks for using Apple GiveBack.

3/1/19: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone XR. Date and Time: March 1, 2019, 8:52 AM PST

3/5/19: Recently you reported an issue with Polarr Photo Editor, Polarr Photo Editor Yearly using iTunes Report a Problem

3/7/19: Your Apple ID, [email protected], was just used to download Lovense [sic] Remote from the App Store on a computer or device that has not previously been used.

3/9/19: New sign-in to your linked account [email protected] Your Google Account was just signed in to from a new Apple iPhone device.

3/9/19: Promise Me, Dad: A Year of Hope, Hardship, and Purpose (Unabridged)

3/13/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: March 13, 2019, 5:43 PM PDT

3/16/19: The following changes to your Apple ID, [email protected] were made on March 16, 2019 at 11:59:16 PM EDT:Email address(es)

Droidhunter88 is added back to Hunter’s iCloud contact again.

3/17/19: You recently added droidhunter[email protected] as a new alternate email address for your Apple ID.

3/17/19: The following changes to your Apple ID, [email protected] were made on March 17, 2019 at 12:02:06 AM EDT: Email address(es)

3/17/19: We haven’t received your device.