How to Think about the Hunter Biden “Laptop”

As noted, yesterday the summary FBI witness in the Hunter Biden trial, Erika Jensen, testified that she did not do an analysis to find out whether any of the files on the laptop attributed to Hunter Biden, “had been tampered with, added to, or subtracted?” She also testified that, as someone who had, “a small basis of my understanding of how [FBI’s digital forensics experts] work” and having not done such an analysis, had not “seen any evidence whatsoever from the data [she] reviewed from [the] laptop to suggest that there was tampering”

Her job was not to do such an assessment. Her job was to do a summary of a very narrow cherrypick of files prosecutors asked her to summarize.

Indeed, her further testimony revealed how useless her opinion on the laptop is. Aside from matching the laptop serial number with one of at least seven laptops Hunter had used in the two years leading up to its delivery to John Paul Mac Isaac in 2019, the only other validation Jensen described was the emailed receipt JPMI sent Hunter Biden’s publicly identifiable email account on April 17, 2019, which is utterly and completely useless to validate the laptop. Jensen further described that she didn’t review any emails beyond a small handful prosecutors gave her. The file did not include the kind of metadata that would be necessary to assess its usefulness.

The investigative team had never validated whether anything had been added to the laptop before October 20, 2020. No one made an index before handing over the data in discovery to Hunter Biden’s team.

While everyone was focusing on Jensen’s testimony yesterday, Zoe Kestan actually gave far more interesting — and useful, for assessing the reliability of his data — testimony about Hunter’s digital life. She described, for example, that fairly early in their relationship, Hunter “sent me images of his credit card and asked me to call hotels and find somewhere for us to stay that night.” Kasten described that Hunter would get 5-minute codes and send them to her and to drug dealers so they could pull money from his ATM without his ATM card. She described how, sometime around March 2018, the two went together to drop broken devices off at an Apple store, but he left and she finished that process.

We went out for dinner one night, we went to the Apple store because his phone and his computer were broken, and he had to leave in the middle, so I dropped off, and you know, submitted his phone and laptop at the Apple store for him.

She testified he lost maybe 5 or 6 phones in the period they were in a relationship, a period intermittently spanning a year (though I think this might be high). She described trying to locate him once by logging into his bank account (the credentials for which were on her machine) to see where he was withdrawing money from an ATM. She described that he would do his business from her laptop.

This is just one person! And she had the means to totally pwn his life. As, too, undoubtedly, some of the drug dealers who supported his habit.

This is the kind of thing I’ve focused on for a long time. In the depths of his addiction, Hunter Biden exercised almost no digital security, meaning his girlfriends, his drug dealers, his sex workers, and even the junkies he partied with all had easy means to compromise his devices. And every time Hunter lost a device — the five to six Kasten testified to, the seven or so laptops he had over that year, two more phones she wouldn’t have known about — every single time, it would present the opportunity for someone to take over his digital identity as a bunch of right wing Trump supporters have since and tamper with it.

With all that said, I want to address all the reasons why no one should be admitting Hunter Biden’s digital data into a criminal trial without proving the provenance of each message.

Start with his iCloud. Contrary to widespread belief — belief sown by false claims from prosecutors parroted by credulous journalists — it is not true that all the data on the laptop was backed up to Hunter’s iCloud account.

As I have shown, only half the messages admitted in the trial came from one of two device backups saved to iCloud (these numbers are based off an early draft of the summary).

But there’s a mistaken belief that everything on his iCloud had to be authentic.

That’s because people like Kasten — and people who undoubtedly have a lot less affection for Hunter Biden — have devices that include the login data for Hunter’s iCloud or for phones that were set to back up automatically to iCloud. People with his devices might also be able to access his two main Gmail accounts, his RosemontSeneca one (which frequently suffered what Google believed to be compromises but which might just be Hunter trying to get in), or the droidhunter account he used for adult entertainment (which was accessed by a burner phone in a period when the droidhunter account had access to his iCloud during the period his digital life was packed onto to the laptop that would end up at the FBI).

The reason Hunter’s cloud data was vulnerable to tampering stems from the way he kept his own — and, per Kasten, his associates’ — laptops. We know from the hard drives shared publicly that that laptop included means to access Hunter’s iCloud, an iPad backed up exclusively to the laptop, the phone from which the most important texts used in his trial were extracted (protected by password), and the cookies and passwords to get into much of the rest of his digital life.

What everyone knows as the [multiple hard drives] copied from the laptop is better thought of as a set of a significant chunk of Hunter’s digital activity (much of it unavailable elsewhere), as well as keys that a sophisticated actor could use to access what was stored in the cloud.

And a whole lot of dick pics.

If we believe John Paul Mac Isaac, then he delivered that entire package of Hunter Biden’s digital life plus another two laptops,to the Mac Shop on April 12, 2019. (Remember that there’s another laptop in the wild, which purportedly was left at Keith Ablow’s guest cottage during the period some of this data was being assembled.)

Whether you believe that part of the story or not is not actually all that important. Except insofar as it raises the chances that what went into JPMI’s store was packaged up to maximal damage. Except insofar as right wingers and gossip columnists posing as journalists claim it gives them license to do anything they want with the data. Indeed, the way that story has been used as license to do something grotesque is about all that story does, whether true or not.

Which may be the point.

JPMI has made it clear he started snooping long before he claims his terms and conditions gave him property rights over the device (even if that extended to the data on the device, which Hunter’s team argues it does not). JPMI’s claims about what alarmed him enough to reach out the FBI and Congress and Donald Trump’s personal lawyer aren’t backed by the documents on the laptop. JPMI’s claims about what laptops he received that day don’t match the laptop shared with the FBI.

In other words, there are gaping holes all over JPMI’s story, which differs from the FBI’s story about what they did with the laptop in key ways.

And yet, that didn’t lead the FBI to validate the laptop associated with the iCloud account of the (then) former Vice President’s son beyond confirming that some but not all of the data matched what was in Hunter’s iCloud.

Whether you believe JPMI or not, he has copped to giving Rudy Giuliani, members of Congress, and through them, the whole world, the gateway to Hunter Biden’s digital life. There’s no defense of that, and yet virtually the entire DC press corps likes to pretend they’re doing ethical journalism if they whitewash it.

There’s not much, yet, to add to the discussion above of how David Weiss used the laptop. As noted above, the FBI never did real due diligence on this laptop.

There’s a lot yet to learn — including whether there was a connection between FBI getting a warrant on the laptop and then DOJ Chief of Staff Will Levi’s text to Bill Barr the next day, “laptop on way to you.”

We do know that the (known) December 2019 warrant only permitted the search of the laptop for the three tax crimes charged against Hunter Biden in Los Angeles (which seems inconsistent with the subpoena that described money laundering). The FBI did not have authority to search the laptop or data from Hunter’s iCloud for gun related evidence until December (though Agent Jensen’s summary of the evidence submitted at trial cited earlier warrants for reasons that have not been aired at trial).

The [hard drive containing the contents of the] laptop is not the same thing as the laptop entered into evidence this week.

That’s something about a bazillion trolls who responded to something I said in 2023, about the disseminated laptop: that it had been tampered with.

It has.

There are known (albeit minor) alterations on the content of the hard drive that Rudy Giuliani shared with the NYPost and, after that, the entire world. There are reportedly more significant compromises, which we might learn about if Rudy’s bankruptcy doesn’t entirely kill Hunter Biden’s lawsuit of Rudy. There was far more significant alteration done on two other sets of data: one, disseminated by Guo Wengui (including some of the files taken down by Twitter in October 2020), and another, released by Jack Maxey.

And there were different public and non-public means of using the hard drives passed on from JPMI to access further Hunter Biden data. Garrett Ziegler, for example, fully admits he compromised the encryption of the iPhone backed up to iTunes on the laptop (though in his response to Hunter Biden’s lawsuit, claims it was legal because the drive he hacked had never belonged to Hunter). Vish Burra is more outspoken about having hacked Hunter Biden.

Many many many of the people who froth over content from the laptop — and journalists who whitewash the hit job against Hunter — don’t know there are multiple versions of altered laptops that relied on multiple means to access (or create) the data.

Many — including many journalists — have just decided Hunter must a horrible person so they are not obligated to care what really happened here.

Hunter Biden’s laptop is not any one thing. It’s not real or authentic or not. It is, rather, the shoddy state of affairs when an entire country enthusiastically exploits the fact that an addict’s digital life was in a permanent state of half-compromise for most if not all of the time of his addiction.

Update: Corrected spelling of Kestan’s last name.

Update: Fixed the super confusing reference about why the FBI didn’t respond differently to the compromise of Biden’s son.

Special Agent Erika Jensen: Watch the Summary Witness’ Blind Spots

The only witness who testified at yesterday’s opening day of the Hunter Biden trial yesterday was a 20-year FBI Special Agent named Erika Jensen. As Derek Hines had her introduce herself, she’s just a summary witness, and as presented so far, almost exclusively with regards to, “addiction and illegal controlled substances.” She’ll probably be on the stand for at least an hour today.

Q. Can you describe the types of crimes you have investigated during the course of your career?

A. I am primarily a criminal agent, so I have worked matters such as drugs, gangs, firearm offenses. I have done white collar, which is bank related crime, corruption, and other criminal matters.

Q. Were you assigned to a criminal investigation of the defendant, Robert Hunter Biden?

A. Yes.

Q. Approximately when were you assigned?

A. In the fall of 2023.

Q. Are you testifying today to summarize certain evidence collected during the investigation?

A. Yes.

Q. What kind of evidence are you summarizing today?

A. It’s going to be evidence of addiction and the use of illegal controlled substances. [emphasis]

Now, it is normal for prosecutors to rely on summary witnesses to admit a bunch of evidence. They used Jensen to admit all the parts of Hunter’s book that made his addiction look really bad, a bunch of communications, and select financial records. It is very common for the summary witnesses to be deliberately compartmented from anything prosecutors want to hide from the defense or jury or public.

In this case, the entire prosecution team (with the very notable exception of David Weiss, who has sat in two courtrooms watching Leo Wise make claims that are not true) is effectively a clean team, made up of people who were not part of a lot of sordid things that happened years ago, sordid things that are likely a big part of the reason David Weiss was originally willing to end this investigation with misdemeanors and a diversion agreement. So after Weiss reneged on that plan, using the disgruntled IRS Agents’ complaints as an excuse, everyone got replaced. Poof! Sordid past becomes plausibly denied.

Jensen adds a layer of compartmentation on top of that. Because she only joined the team in the fall, for example, she is likely entirely compartmented from the way Leo Wise chased Alexander Smirnov’s fabrications about Joe Biden. She didn’t do any of the exploitation of the digital evidence. She’s likely not the person who told Derek Hines that sawdust is cocaine, though whoever did was likely playing the role she’s now playing. She’s not the person who made a show of reviewing the digital data after prosecutors finally got a warrant to search for gun crimes in December 2023; a Special Agent named Boyd Pritchard did that (indeed, her summary claims to be relying on the 2019 and 2020 warrants to access the data, something that may come up in cross today).

Again, all of this is common, if not expected. If trials provided opportunity to learn what really went on in criminal investigations, there’d be fewer guilty verdicts.

There are, however, some embarrassing things that Jensen does or likely knows. For example, it appears that, after prosecutors frothed up the entire dick pic sniffing brigade by claiming the pouch in which the gun was found had cocaine residue, they discovered Hallie Biden put the gun there, as Hines made clear in his opening argument.

Hallie found the gun, as well as his drug paraphernalia, drug remnants scattered in the truck. Concerned about the gun, she decided to get rid of it. She panicked, she put the gun in the defendants leather pouch, which was also in his truck, a leather pouch which he used to store his crack cocaine, an accessory, she put the gun, pouch, speed loader and ammunition in a gift bag.

Additionally, Jensen interviewed Gordon Cleveland — alone, a no-no in FBI procedure — about why the gun shop doctored the gun purchase form. That means she’s the only witness to Cleveland’s observation that he doesn’t much care about the documentation. But since that’s not yet in evidence, it’s not clear Lowell will be able to cross-examine her on it (which may have contributed to prosecutors’ decision to start by proving that Hunter was an addict — to protect both Jensen and Cleveland’s credibility after they both did something stupid, though they could bring Jensen back to summarize everything else).

Prosecutors use summary witnesses to protect weaknesses in their case.

But because they do, you can sometimes learn something about a case from the negative space outlined by the testimony of a summary witness. It points to areas where prosecutors wanted their summary witness to remain intentionally dumb.

A glaring example evident already from Jensen’s testimony is Keith Ablow. Derek Hines had Jensen introduce the invoices from a rehab center Hunter attended in August 2018, which will admittedly be an absolutely critical issue of contention going forward (because prosecutors only have testimonial evidence that Hunter used drugs between then and when he bought a gun).

Q. What does the top show, page 1?

A. So the top shows where the e-mail was received from at The View, and it’s sent to [email protected], and the date of 8/22/2018, the time and the attachment of invoice.

Q. What is The View?

A. The View is a detox center, rehab center.

Q. Where is it located?

But he didn’t have her pull invoices relating to the Keith Ablow Ketamine treatment. And when Abbe Lowell asked her about it on cross, she said she was not going to pull any of that evidence, and so could only offer a vague date about when it was.

Q. That’s when he left Delaware to go to Massachusetts for another form of rehab. Isn’t that what happened in the chapter? Isn’t that the date? After —

A. I have a date when he went to Massachusetts, that I saw — I’m not going to pull that from the excerpts though, I don’t know that we have that, but it was November, mid November is what I believe.

Q. So after the October incidents, he goes to Massachusetts and there he is entering another form of rehabilitation, is that your understanding of the timeline?

A. Yes. Yes.

So it was left to Lowell to point out that a great deal of the texts on which she relied came from after that treatment, well after Hunter ever owned a gun.

Q. And then the texts that I started with when I was asking you questions start in the end of 2018 after November, to 2019, we established that timeline; right? I’m sorry, we established that timeline — sorry, we established that timeline, that the —

A. Yeah. Yes, we went over messages from February of 2019.

Q. Following his going to Massachusetts which you and I just established was in November of 2018?

A. Correct.

Q. And that was after the October purchase of the gun?

A. Yes.

Q. And that was after the gun was no longer in his possession?

A. Yes.

Remember: Hines has always very deliberately buried this passage from Hunter’s book.

The therapy’s results were disastrous. I was in no way ready to process the feelings it unloosed or prompted by reliving past physical and emotional traumas. So I backslid.

Unless I’m misunderstanding the excerpts that did come in (which were wildly skewed to years long before he owned a gun), it’s not in evidence. So when Hines relied heavily on some 2019 communications to try to suggest a continuity to Hunter’s addiction yesterday, he didn’t tell the jury that, at least according to Hunter’s own reconstruction, what Hines is relying on is actually worse than his state in 2018, when he bought a gun.

Hines has always been relying on Hunter’s state after Keith Ablow got to him, but yesterday he tried to entirely obscure that fact.

No doubt because he’s relying on massive bank withdrawals as a proxy for spending on drugs the consumption of which he has no direct proof, Hines similarly did not have Jensen tally out what Hunter was spending money on in fall 2018 (and there has been no mention of sex worker payments, which both the prosecution and defense know, but will not explain, made up a big part of those expenses).

Q. And can you go to the next page. It says August 21st. Can you go to the next page? With the amount 5,000. Can you go to the next page, please? And then the next page. And you see the dates, August 23rd of ’18, do you see that?

A. Yes.

Q. Okay. The next page, please? And there is another amount. And then the next page. And it says stabilization, there is another amount. Do you know who paid those invoices?

A. I think I know who paid part of them

Q. Go ahead.

A. But I don’t — I’m trying to think of my source of information, I think it was partially paid, I seen a record in Mr. Biden’s bank account for at least a payment, yes, and I think there were family assisting.

Q. When you were pointing out, for example, the issues of his bank account and the $5,000 that you then talked with Mr. Hines and the other amounts of a few thousand dollars, did you match up those withdrawals to these invoices?

A. No.

Prosecutors use summary witnesses to introduce a lot of evidence, but also to protect weak parts of their case. So it’s worth tracking the negative spaces of where they don’t ask summary witnesses to look.

That may become interesting this morning, as Lowell continues cross-examination.

Jensen’s introduction of the digital evidence was very cursory. Thus far, for example, Jensen’s description of how investigators validated the laptop is laughable.

Q. Ultimately in examining that laptop, were investigators able to confirm that it was Hunter Biden’s laptop?

A. Yes.

Q. How?

A. Among other things, there was a serial number that’s on the back of this laptop that matches the Apple subpoena records that they obtained in 2019, so it matches the registration of this particular device to the iCloud account at a particular date.

Q. And is that serial number FVFXC2MMHB29?

A. Yes.

Q. And that’s also in the Apple records, you said?

A. Yes.


Q. Now, you mentioned being able to corroborate that that was in fact the defendant’s laptop. Did you also see information on the laptop when it was examined that showed that he had dropped it off at the MAC shop?

A. So, there was an e-mail that was obtained from the iCloud warrant returned, that showed an invoice from the MAC Shop to Mr. Biden with the — yes.

Q. I’m showing you Exhibit 40. Is that the e-mail you just referenced?

A. One second. Yes.

All she has done, so far, is show that the laptop was at one point registered to Hunter’s account and that John Paul Mac Isaac sent Hunter’s publicly identified email account an invoice. That’s not remotely adequate validation (and note, Hines uses the word “corroborate,” not “validate”). Notably, Hines didn’t ask her about several other things we know Lesley Wolf originally relied on to claim validation, most importantly, calls to and from a phone number belonging to Hunter, as well as a cigar bar purchase. Hines also asked her whether the was Hunter’s, not whether it had a clean chain of custody.

So this, too, may become an interesting negative space as cross-examination resumes.

Keep an eye on the summary witness’ deliberate blind spots and negative space: because that’s precisely what prosecutors are trying to hide.

Update: I’m reading today’s transcripts and several intentional blind spots are clear.

First, she knows almost nothing about finance. She knows less about Hunter’s corporate person, Owasco PC, than about 50 Congressional interns. She didn’t track money flow. She doesn’t know how Hunter paid for rent or where he lived.

And she looked at almost no emails. Which is especially nutty, because she used an email to validate the laptop.