Posts

Happy Delaware Laptop Day, for Those Who Celebrate

/144 Comments/in , , /by

If I read the docket correctly, in a courtroom in Delaware today, Judge Robert Robinson will hear John Paul Mac Isaac’s motion to dismiss and Hunter Biden’s motion for summary judgement in the suit and countersuit over whether JPMI was legally entitled to first snoop through and then start disseminating data from a laptop JPMI claims to believe was dropped off by Hunter Biden, and whether a single statement Hunter Biden made about possibly being hacked that didn’t even name JPMI could be considered defamation.

Because CNN and Politico will also be arguing their motions to dismiss against the blind computer repairman in a follow-on to the same hearing, we might get some press coverage of the hearing. If not, it’s possible that a hearing that has the possibility of roiling 40 months of relentless Murdoch propaganda and both criminal cases against Hunter Biden will go uncovered.

No dick pic sniffer can control their glee that Hunter Biden has a deposition before Congress next week; they don’t seem to give a shit — or, even know — that a hearing that may determine the legal status of the laptop is happening today.

To mark the day, I wanted to return to a few details from Hunter Biden’s reply motion to compel from the other day.

First, on pages 3-4 in the section rebuking David Weiss for calling Keith Ablow’s photo of a photo of a table saw and sawdust a picture of Hunter Biden’s cocaine, the filing includes the text exchange explaining the photo.

2 The message excerpt on the following page is found on the data image provided to Mr. Biden by the prosecution (iPhoneXS_Chat_00000132). There is no Bates stamp for this material as discussed in Mr. Biden’s opening motion. (See Mot. at 18.)

The text appears to come from the iPhone XS that Gus Dimitrelos described as being encrypted on the device, along with a handy password stored right there on the laptop. Readers who have been following my voyage down the Hunter Biden rabbit hole will remember it all started when I read Gary Shapley’s notes indicating that the FBI, too, used a password discovered on the laptop to access the phone.

Laptop — iphone messages were on the hard drive but encrypted they didn’t get those messages until they looked at laptop and found a business card with the password on it so they were able to get into the iphone messages [my emphasis]

I opined at the time that, while the FBI might get away with accessing this encrypted device without a separate warrant, anyone else who accessed it — as Garrett Ziegler keeps confessing he did — may have committed a CFAA violation. Curiously, though, the FBI did get separate warrants for all the other devices backed up separately. That’s what the July 10, 2020 warrant did: permit the FBI to access four device backups that were already in hand, but that were separate backups.

Not this phone, though, the phone on which the photo of the photo of the table saw and sawdust that David Weiss claimed was cocaine might be found.

So on pages 3-4, Abbe Lowell explained that one place you might find Keith Ablow’s photo of the photo of the table saw and sawdust that Weiss misstook for cocaine was on a phone that was encrypted when the FBI first got the laptop.

Starting 16 pages later, Lowell returned to his request that prosecutors actually describe where they found particular pieces of evidence. Lowell explained that, yes, while it is true that last August he asked for an exact copy of the laptop, which “will be needed, for example, to challenge the chain of custody, provenance, or likely tampering with the data before it came into the possession of the government,” he also expected that prosecutors would provide some roadmap for where they’ve found things.

The prosecution mixes apples with oranges in charging that Mr. Biden is being “dishonest and misleading” in objecting to what the prosecution contends was a laptop it obtained being produced in the native format that he requested (Opp. at 19), but that is disingenuous. To be sure, Mr. Biden asked for an exact copy of the laptop so it could be examined in the same way in which it was originally found, which is helpful in making a forensic examination of the laptop. That will be needed, for example, to challenge the chain of custody, provenance, or likely tampering with the data before it came into the possession of the government.

However, this motion seeks something more—something traditionally provided in discovery. The crux of Mr. Biden’s complaint here is that the prosecution has not supplemented that production with an index or some other means that would identify which of the vast materials on the laptop the prosecution believes are relevant to this case. The request for the forensic copy is not the same. If the prosecution is claiming that it has not indexed the 220 gigabytes of data (which would be an odd statement), then it needsto say that, and, as with other requests, the dispute will end. If it does have what it normally has with vast amounts of e-data, without providing more, the defense is in a needle in a haystack situation.

Then he noted that the labels Derek Hines used for where investigators found things weren’t all that helpful, because those “titles [] are not even remotely descriptive of what they contain.”

This amount of mixed media data in this tech age is difficult to navigate. The text messages and photos cited by the prosecution in its motions, for example, are difficult to locate. They are “buried” in a convoluted collection of different backup folders and files and are not stored in one streamlined digital backup or application. The messages and photos cited come from “Apple iCloud Backup 01”; “Apple iTunes Backup”; “Apple iCloud Backup 04”; and “iTunes Backup (iPhone 11),” titles that are not even remotely descriptive of what they contain. (See DE 86-1.) For this reason, Mr. Biden requested an index of material (which the prosecution has now clarified it does not have), or Bates stamps for that which it had cited. (Opp. at 19.)

And not just what they contain, I’d add. The label, “iTunes Backup (iPhone 11),” which is where Hines described finding the photo of a photo of a table saw and sawdust almost certainly couldn’t be what Hines described it as — an iPhone 11 — because (as zscoreUSA noted) Apple didn’t announce the iPhone 11 until September 10, 2019, after the laptop was dropped off at JPMI’s shop and after a warrant was served on Apple.

I asked David Weiss’ spox about this, but it was another of a growing stack of questions of mine to which he didn’t even bother responding.

And Abbe Lowell — curse you! — isn’t much more help. Given his response that prosecutors have now fulfilled his request for guidance on where they found things, he must know whether iTunes Backup (iPhone 11) is that iPhone XS that was encrypted on the hard drive, but he’s not telling either.

In his opening motion, Mr. Biden merely requested, following the prosecution’s citation to myriad text messages and photos in its responses, that the prosecution indicate where on the image it provided Mr. Biden could find those referenced materials. (Mot. at 18.) The reason for this request was straightforward at the time: defense counsel could not locate certain of the messages and photos given the broad date ranges used by the prosecution to describe them (e.g., photos taken “Prior to October 12, 2018”; messages sent “prior to his gun purchase”; and photos taken “During November and December 2018”). (DE 86-1.) Mr. Biden appreciates that with the Exhibit filed with its opposition, the prosecution has now fulfilled this part of his request.

But Abbe Lowell did say this: at a meeting in August of last year, the first time when Lowell asked for a complete copy of the laptop (he had to ask again a month later), prosecutors told him that they had “independent sources” for everything helpful to their case.

As to the meeting between Mr. Biden’s counsel and prosecutors in Wilmington on August 29, 2023 (Opp. at 19), Mr. Biden notes that prosecutors indicated, during that meeting, that they possess “independent sources” for any material on the laptop device that would be helpful to the prosecution’s case, presumably referring to material subpoenaed from third parties, such as Apple, Inc. or various cellphone carriers. For this reason, it was curious to Mr. Biden’s counsel when reviewing the prosecution’s response that it elected to cite to and quote from messages and photos contained on the device it possessed (lacking any Bates stamps) rather than from those “independent sources” included in the discovery produced to the defense. That is precisely why Mr. Biden requested the prosecution indicate where on the device he could find the quoted messages and referenced photos, and why he suggested these files were “left buried” among a set of voluminous files that, as made clear now, span multiple iPhone, iTunes, and iCloud backups. (Opp. at 19 (quoting Mot. at 17).) Nevertheless, Mr. Biden appreciates the prosecution providing the folder locations of the messages and photos it referenced. [my emphasis]

Remember: when they said that on August 29, 2023, they still had never obtained a warrant to search the laptop, or any of Hunter’s Apple content, for that matter, for evidence to support the gun crime. They also had not, and still have not, indexed the laptop so they know what is on there and how it got there.

And prosecutors are still saying that everything they need is available on Hunter’s iCloud account. Sort of. In the passage of the response where Hines raised this August 2023 request, he insisted that, “the primary source of evidence in this case is the evidence obtained from the defendant’s Apple iCloud account, which was produced to the defendant in a readily searchable format.”

No. No it is not. Here’s my updated table of what Hines included in his exhibit, updated so that the photo of a photo of a table saw and sawdust appears where it temporally belongs, showing that an iPhone XS received a text from Keith Ablow on November 20, 2018, the same day that some anomalous activity was happening with Hunter’s droidhunter account and in a period when an iPad attributed to Hunter was otherwise sending (but with just one exception, not necessarily delivering) a whole bunch of texts about being an addict. I’ve highlighted the records that don’t include hex numbers and aren’t obviously sourced to one of the iCloud backups for dramatic effect. Lowell’s comment seems to confirm that Derek Hines sourced the highlighted records to the laptop.

In addition to the sawdust photo and one of a box that, a new commenter noted is also not from Hunter, it is from Hallie, and even if it indicates drug use, it is much earlier drug use, the most important texts to the government’s case, the ones between Hunter and Hallie while he possessed the gun, appear to be sourced to the laptop.

So in August, at a point when prosecutors had never gotten legal permission to search the laptop for evidence of gun crimes, they nevertheless assured Abbe Lowell that everything they needed was available via verifiable sources. And then this month — just days before a Delaware court may resolve the matter of whether JPMI owned the laptop when, he claims, an FBI agent told his father to lawyer up because, “You may be in possession of something you don’t own” — Hines claimed that, “the primary source of evidence in this case is the evidence obtained from the defendant’s Apple iCloud account, which was produced to the defendant in a readily searchable format.”

And then he sourced the most important texts to his case to the laptop — a source that not only isn’t readily searchable, but is not even indexed.

Happy Delaware laptop day, everyone. Things might start to get interesting.

Update: The docket reflects that Judge Robinson reserved judgment on Hunter Biden’s motion for summary judgment and CNN and Politico’s motions to dismiss.

Update: NBC’s Gary Grumbach did a thread on the hearing. By his description, Hunter Biden will kill the suit against him easily (unsurprisingly, as he didn’t even mention JPMI’s name). But Grumbach didn’t include much of what must be a legal discussion about JPMI’s decision to release the information to Rudy.

Update, from comments: A detailed local report on the hearing, providing the detail that the biggest problem for Hunter’s claims are that he waited too long to sue.

Illustration of all the dissemination implicated in today’s hearing from Thomas Fine.

Click here for Hunter Biden’s Eight Legal Chessboards including links to all filings and schedules for other cases, including the Delaware lawsuit.

Judge Mark Scarsi Refuses Accommodations That Trump’s Judges Have Granted

/67 Comments/in , , /by

While the judges in former President Trump’s federal prosecutions have been issuing reasonable (in Tanya Chutkan’s case) and unreasonable (in Aileen Cannon’s case) extensions in pretrial deadlines, the judge in Hunter Biden’s Los Angeles case seems intent on keeping a politically damaging trial scheduled for the middle of campaign season, June 20.

Last week, Abbe Lowell requested two accommodations in the pretrial schedule in Los Angeles: first, that he be permitted to hold off filing the four (actually, three) filings fully briefed before Judge Maryellen Noreika that he will also file in Los Angeles: a motion to dismiss based on immunity under the diversion agreement, a selective and vindictive prosecution claim, and a claim that David Weiss was improperly appointed. Lowell also mentioned the constitutional challenge to the gun charge, but that won’t be filed in Los Angeles. At the initial appearance, Lowell said instead there would be one based on “the actions of the IRS agents that were involved.”

Here’s an updated version of my Howard Johnsons-colored table showing how all these cases interrelate, including the filings we should expect in both federal cases; I’ve put an updated version of the eight cases Lowell is juggling below (and have started tracking them here).

Lowell did not mention the as-yet unfiled motion to suppress the laptop he said he’d file in Delaware on January 30. I’ll come back to that.

In addition, Lowell requested a 3-week extension on the initial filing deadline, from February 20 to March 12, for the motions that will be unique to Los Angeles; he did not mention a filing about the IRS agents, but did mention motions on the Statute of Limitations (presumably affecting just the 2016 tax year), venue (possibly affecting both the 2016 and 2017 year), and multiplicity. To justify that, he cited a death in the family of one of the lawyers working on these filings, as well as several other deadlines pending:

  • Responses to motions to dismiss in the Garrett Ziegler and Rudy Giuliani lawsuits at the end of the month
  • A February 22 hearing in the John Paul Mac Isaac suit and Hunter’s countersuit
  • Hunter’s February 28 impeachment deposition in the House

Judge Scarsi denied the motion with no comment.

To be sure, I’m not remotely surprised Scarsi denied Lowell’s motion to hold off on the identical motions already filed in Delaware.

At the initial appearance on January 11, Scarsi raised those filings himself.

[T]he Court has gone through and actually read what’s been filed so far in Delaware. So the Court wanted to come up to speed on the issues [at] play here. And so, we’ve got — at least we’re up to speed in what’s been filed so far.

The parties have spent, it looks like, a lot of time, or will spend time briefing issues in Delaware. And I think that should help us expedite matters here, because it wouldn’t surprise me if some of the same issues raised in Delaware are raised in this Court. In fact, the Court anticipates that happening.

Scarsi even ordered the parties to cut the 70-page filings submitted before Judge Noreika down to something like 20, double his normal limit of 10 pages (the parties have yet to file a stipulation showing that’s what they’ve agreed on).

[T]he parties know from reading the Court’s standing order, the Court’s standing order in criminal contemplates that the page limitations on motions is 10 pages. Motions and oppositions, and replies not necessary.

Now the Court is willing to grant the parties a little leeway here, to exceed the page limits, you know, contemplating doubling them, at most.

Scarsi even recognized that the diversion filing might trigger an interlocutory appeal, because he warned Lowell that the precedent (which he named) governing interlocutory appeals in the Ninth Circuit is fairly limited and directed him to address that issue in his initial filing.

At the time, Lowell knew the briefing deadline before Judge Noreika, and so could have requested to hold those three identical motions at that point.

Plus, it’s not the case that the motions will be identical. The diversion filing in Los Angeles will and always would have been mostly a place-holder; if Noreika rules against Hunter regarding the diversion agreement, then there would be no basis to make the same claim in Los Angeles absent an interlocutory appeal in Delaware. It’s only if she rules for Hunter that Lowell’s claim that the immunity in the gun diversion extends to the tax case would come into play.

The selective and vindictive prosecution filing in Los Angeles will have to swap the comparators showing how no non-violent person in recovery from addiction has been charged with the same gun charges in Delaware with comparators showing that no one who has paid their taxes, much less someone who — Abbe Lowell claims but has not yet shown proof — overstated their income has been criminally charged, with a mention of Roger Stone’s more lenient treatment as well. Lowell mentioned the two tax laws criminally prohibiting the kind of pressure that Trump exercised in Hunter’s case only in passing; they would seem to be far more central here. And given the fact that the US Attorney for Los Angeles, Martin Estrada, was among those threatened as a result of the political pressure on this case, it would seem useful for Lowell to raise the threats elicited by those demanding this prosecution.

Even the Special Counsel challenge could be tweaked given Weiss’ admission to Congress that he has never been subject to the kind of oversight from political appointees that Morrison v. Olson requires. Weiss was already functioning as a Special Counsel before demanding appointment as such, presumably to get the opportunity to write another political hit piece targeting a Biden man (or men).

I’m not even that surprised that Scarsi refused to budge on the schedule. At the initial appearance he not only warned that he likes to move quickly,

Again, if we’re going to move this case either forward or expeditiously, and efficiently — and that’s what this Court likes to do. We like to move things along, because I think it’s better for all the parties and we don’t have things linger.

But Scarsi also suggested that because he set a schedule first, Judge Noreika should now have to accommodate his schedule.

So what I’m going to do is, I’ll go ahead and issue an order with those dates. That will hopefully prevent conflict with Delaware, because this order will be in place and the Court in Delaware will likely be aware of it.

So Lowell was on notice of all of that.

There’s one thing Lowell wasn’t on notice of on January 11, and his request for a delay may be about something other than the motions to dismiss.

Delaware Superior Court Judge Robert Robinson only set the February 22 hearing in the John Paul Mac Isaac lawsuit and Hunter’s counterclaim on February 1 at 8:52 AM. Per Lowell’s declaration and email record, 38 minutes after Robinson set that hearing, Lowell first reached out to prosecutors about this delay (in their dickish fashion, they blew him off for six days).

If Robinson were to rule in Hunter’s favor — if he were to rule that, under Delaware law, JPMI didn’t own Hunter’s laptop when he first offered it up to the FBI on either October 9 (JPMI’s version) or October 16, 2019 (FBI’s), less than a year after someone who may or may not be Hunter Biden dropped it off, if he were to rule that JPMI violated his own promise to protect Hunter Biden’s data, not least by snooping through Hunter’s data well before even he, JPMI, claimed his intake form gave him ownership of the laptop — then it might have fairly dramatic impact on any motion to suppress the laptop.

That’s true, not least, because (if you can believe JPMI and it’s not clear you can), after JPMI sent a hard drive with the data across state lines to his father, the FBI told his father that, “You may be in possession of something that you don’t own.” After which JPMI and his father sent that same data across even more state lines, including to Congress and Rudy Giuliani. And yet rather than opening a criminal investigation into JPMI for interstate trafficking of the potentially stolen data of the former Vice President’s son, David Weiss instead decided to build an entire case around that data.

Worse still, JPMI’s public claims about what he saw in the data are obviously false: of particular note, there are no known emails substantiating his claims that the laptop showed, “information about Ihor Kolomoyskyi and Mykola Zlochevsky, and their involvement in using Hunter and Devon to protect the billions they embezzled from the IMF.” The crime of which JPMI told the FBI they’d find evidence on the laptop was entirely made up — and made up to create a video that might serve Trump’s impeachment defense.

Lowell’s motion to compel — submitted in Delaware two days before that hearing was set — describes receiving “The Mac Shop files.” It doesn’t describe receiving the initial FBI legal review that concluded JPMI and his father likely didn’t own that laptop or data. It doesn’t describe receiving the 302s documenting the FBI’s interactions with JPMI (302s that were also not shown to case agents who might have to testify at trial). If warnings that JPMI didn’t own this data really exist, and if prosecutors are withholding it to cover up real problems with their reliance on the laptop, it would be fairly important evidence.

A favorable Delaware ruling would likely have more impact on the Los Angeles case than anything but a ruling in favor of Hunter’s diversion argument in Delaware, because it would show that David Weiss chose to use poison fruit to investigate Hunter Biden rather than pursue a case of interstate data theft. The SDNY case against those who stole Ashley Biden’s diary and a thumb drive with tax records and photographs on it and trafficked them across state lines shows that such things can be prosecuted.

At the initial hearing, Scarsi told Lowell that the, “February 20th date is for motions that you know now that you intend to bring.” When Lowell said he’d file a motion to suppress the laptop and everything else in Delaware, he pointed to several other things — such as reliance on witness testimony from a Los Angeles grand jury post-indictment and the filing for the warrant itself post-indictment — to get as a basis to suppress. Lowell still hasn’t mentioned a motion to suppress the laptop to Scarsi. He’s likely now trying to determine whether he can and should wait on a ruling from Robinson before he files such a suppression motion to Scarsi, who has promised to rule expeditiously.

It’s not surprising that Scarsi denied Lowell’s request (though it is a telling contrast to the treatment Trump is getting).

But it is also the case that these moving parts really may affect the case before him.

Update: Abbe Lowell has filed a status report in the Delaware case in case Judge Noreika decides she doesn’t want Scarsi to preempt her.

1) Delaware Gun Case (Maryellen Noreika)

[RECAP docket]

September 14: Indictment

October 3: Arraignment

October 12: First Discovery Production (350 pages focused on gun case), including iCloud data and “a copy of data from the defendant’s laptop”

October 13: Motion to Continue

October 19: Order resetting deadlines

November 1: Second Discovery Production (700,000 pages on tax charges — no mention of FARA investigations)

November 15: Hunter subpoena request

December 4: Weiss subpoena response

December 11: Motions due

December 12: Hunter subpoena reply

January 9: Third Discovery Production (500,000 pages focused on tax case)

January 16: Responses due

January 30: Replies due

January 30: Motion to compel

2) Los Angeles Tax Case (Mark Scarsi)

[RECAP docket]

Hunter was indicted on December 7 and made a combined arraignment/first appearance on January 11. At that hearing, Judge Mark Scarsi set an aggressive (and, from the sounds of things, strict) schedule as follows:

February 20, 2024: Motions due

March 11: Response due

March 18: Replies due

March 27 at 1:00 p.m.: Pretrial motion hearing

April 17: Orders resolving pretrial motions.

June 3 at 1:00 p.m.: Status conference

June 20: Trial

3) House Dick Pic Sniffing (James Comer and Jim Jordan)

November 8: James Comer sends a pre-impeachment vote subpoena

November 28: Lowell accepts Comer’s offer for Hunter to testify publicly

December 6: Comer and Jordan threaten contempt

December 13: Pre-impeachment deposition scheduled; Hunter gives a press conference and states his data has been “stolen” from him

December 13: Impeachment vote authorizing subpoena

January 10: Oversight and Judiciary refer Hunter for contempt

January 12: Lowell invites Comer and Jordan to send another subpoena, now that they have the authority to enforce it

January 14: Jordan and Comer take Lowell up on his invitation

February 28: Deposition

4) IRS Lawsuit (Tim Kelly)

[RECAP docket]

September 18: Privacy Act lawsuit

November 13: DOJ asks for extension to January 16

January 16: DOJ files motion for partial dismissal

January 23: Joint motion to continue

January 30: Original deadline for Hunter response

February 5: Amended complaint

February 9: DOJ asks for delay for response from February 20 to February 27

5) John Paul Mac Isaac’s Suit and Hunter’s Countersuit (Robert Robinson)

Last summer, John Paul Mac Isaac and Hunter both sat for depositions, on May 31 and June 29, respectively.

Last fall, Hunter Biden subpoenaed people like Rudy Giuliani, Robert Costello, Steve Bannon, Yaacov Apelbaum (who made a copy of the contents of the laptop), Tore Maras (who has described adding things to the laptop). In November, Hunter also served a subpoena on Apple.

On January 4, the parties to John Paul Mac Isaac’s suit and countersuit filed to have their pending motions decided by a judge. The media defendants — CNN and Politico — are filing to dismiss. Hunter and JPMI filed competing motions for summary judgment.

And Hunter is filing to quash a bunch of subpoenas, initially 14, to Hunter’s parents, uncle, ex-wife, former business partners, and several people with his father, like Ron Klain and Mike Morell. Though after that, JPMI attempted to subpoena Hunter’s daughters.

Since then, Judge Robinson stayed John Paul Mac Isaac’s subpoenas and scheduled hearings in the Motions to Dismiss (from CNN and Politico) and Motions for Summary Judgement (from Hunter and JPMI) for February 22.

6 AND 7) Hacking lawsuits against Garrett Ziegler and Rudy Giuliani (Hernan Vera)

[RECAP Ziegler docket; RECAP Rudy docket]

September 13: Complaint against Ziegler

September 26: Complaint against Rudy and Costello; noticing Ziegler suit as related case

November 15: Ziegler gets 30 day extension

December 1: Costello gets 30 day extension

December 7: After swapping attorneys, Ziegler gets extension to December 21

December 21: Ziegler motion to dismiss and request for judicial notice (heavily reliant on JPMI suit)

January 17: Costello motion to dismiss with Rudy declaration that makes no notice of his fruit and nuts payments relating to Hunter Biden

January 22: Lowell successfully requests to harmonize MTD hearing for both hacking lawsuits

February 8: Rescheduled date for hearing on motion to dismiss

February 22: Rescheduled date for hearing on motion to dismiss

End of February: Response to motions to dismiss due

March 21: Joined date for hearing on motion to dismiss

8) Defamation against Patrick Byrne (Stephen Wilson)

November 8: Complaint

January 16: After swapping attorneys, Byrne asks for 30 day extension

February 6: Rescheduled response date

The Hunter Biden Laptop: Two CARTs before the Horse

/118 Comments/in , , /by

According to the property receipt that has been posted publicly (but not, as far as I know, been made available as separate PDF), FBI Special Agent Josh Wilson signed the receipt for a hard drive and laptop obtained from John Paul Mac Isaac. The date is obscure, but consistent with receipt on December 9, 2019.

The admittedly inconsistently dark case file on that form, as right wing frothers never tire of pointing out, is a money laundering case file, 272D-BA-3065729.

According to the warrant return I liberated this week, on December 13, 2019, Josh Wilson received the hard drive and laptop again. He received the laptop not from an evidence locker, where it might normally go while an agent gets Office of Enforcement Operations approval and then gets a warrant from a magistrate judge, but from a Computer Analysis Response Team (CART) Computer Analyst named Mike Waski.

The warrant I liberated is not for money laundering. The only crimes listed on Attachment B are tax crimes: 26 USC 7201, 26 USC 7203, and 26 USC 7206(1).

According to the notes Gary Shapley took after it became clear that, after sharing the laptop with the FBI, John Paul Mac Isaac shared a copy with Rudy Giuliani, after Josh Wilson took possession of the hard drive and laptop (a second time), the hard drive, at least, went back to CART — this time, a CART Agent named Eric Overly.

In spite of the fact that Shapley made these notes in order to explain precisely what happened with the laptop, Shapley doesn’t mention where the laptop was between December 9, 2019, when Josh Wilson took possession from JPMI and December 13, 2019, when Josh Wilson took possession again.

Joseph Ziegler returned the warrant on January 30, 2020. But it wasn’t until March before the FBI got an image of the laptop (though this may have been after a filter team review). Josh Wilson got that personally, too.

Putting two carts before the horse is not normal, here. When the FBI accepts a laptop, even if it is being used in multiple investigations, they image it once and then — as ultimately happened here, probably multiple times — they obtain new warrants for the same device, first for the tax investigation, then for a FARA investigation, and finally, 81 days after indicting the President’s son for gun crimes, for a gun investigation.

But this laptop, Hunter Biden’s laptop, went from the blind computer repairman to Josh Wilson to CART to Josh Wilson and then back to CART.

I currently have theories why that happened. But no answers.

I’ve asked David Weiss’ spox for clarification about zscoreUSA’s observation: why the caption for the warrant obtained last month lists a different device serial number for the laptop:

Then the laptop for the actual laptop obtained from JPMI, which is what appears in the Attachments that were only released pursuant to Judge Maryellen Noreika’s orders after I made some follow-up calls.

The serial numbers are just off by two characters:

  • FVFVC2MMHV2G
  • FVFXC2MMHV29

David Weiss’ spox hasn’t acknowledged that inquiry. This could be a typo or, as was suggested, FBI Agent Boyd Pritchard may have used the serial number for a laptop into which (as Shapley described) FBI dropped the removable hard drive from the laptop obtained from JPMI. In that case, it would normally note that the laptop contained the hard drive liberated from a prior laptop.

Perhaps all this will get sorted if and when Abbe Lowell makes good on his promised suppression motion. But until then, I only have theories, not answers.

John Paul Mac Isaac’s Serial Inaccuracies and the Ablow Laptop

/108 Comments/in , , , /by

Right wing purveyors of the Hunter Biden “laptop” story say that John Paul Mac Isaac, the legally blind computer repairman who made a copy of a laptop that he said Hunter Biden dropped off, then sent a copy of the data to Rudy Giuliani, was perfectly entitled to do so. They point to the intake form JPMI used, stating that,

Equipment left with the Mac Shop after 90 days of notification of completed service will be treated as abandoned and you agree to hold the Mac Shop harmless for any damage or loss of property.

In Hunter Biden’s countersuit against JPMI, he noted that Delaware law only deems tangible personal property to be abandoned after a year, and requires some bureaucracy before someone can assert to own the property.

8. Contrary to Mac Isaac’s Repair Authorization form, Delaware law provides that tangible personal property is deemed abandoned when “the rightful owner has left in the care or custody of another person and has failed to maintain, pay for the storage of, exercise dominion or control over, and has failed to otherwise assert or declare the ownership rights to the [] property for a period of 1 year.” (25 Del. C. § 4001) (emphasis added). The procedure to obtain lawful title to abandoned personal property requires the person in possession of the property to file a petition in a court of competent jurisdiction. (25 Del. C. § 4003). Other obligations must then also be satisfied before obtaining lawful title, such as the court sending notice to the owner and the petitioner posting notice in five or more public places, and advertising the petition in a newspaper. (25 Del. C. § 4003(b)). [emphasis original]

The requirements of Delaware law have attracted the most attention amid debates whether JPMI was entitled to share the laptop with Rudy Giuliani.

More important to questions of Computer Fraud and Abuse Act lawsuits like the one Hunter filed against Rudy Giuliani, however, Abbe Lowell notes that JPMI’s intake form promises to “secure [his customers’] data.”

12. Moreover, even if the Repair Authorization form were enforceable under Delaware law, by its own terms, it provides abandonment of only any “equipment” that is left behind at the Mac Shop, and not the data on or embedded within any such equipment. In fact, the Repair Authorization form states that the Mac Shop will make every effort to “secure your data.” (Compl. Ex. A). Customers who sign Mac Isaac’s Repair Authorization form do not, therefore, waive any rights under Delaware law for the data that any equipment might contain. Reputable computer companies and repair people routinely delete personal data contained on devices that are exchanged, left behind, or abandoned. They do not open, copy, and then provide that data to others, as Mac Isaac did here.

13. At no time did Mr. Biden grant Mac Isaac any permission to access, review, copy, or disseminate for his own purposes any electronically stored data that ever was created or received or maintained by Mr. Biden (regardless of how Mac Isaac came into possession of such material). [my emphasis]

Hunter Biden did not, if he indeed signed that intake form, authorize JPMI to grant other people access to his data. Yet JPMI gave it to Rudy who gave it to half the world, including the NY Post, as this illustration from Thomas Fine lays out.

There are multiple theories of CFAA that Abbe Lowell might have in mind as he sues those who’ve disseminated Hunter’s data: I discussed that cracking the password of the iPhone stored on the device or accessing data stored in the cloud might qualify. It’s also possible, however, that Lowell would argue that simply accessing the drive that JPMI shared amounts to unauthorized access, even under JPMI’s own intake form, because he said he would keep the data secure.

Those details will undoubtedly be a part of all the litigation going forward.

But there’s another detail about the intake form that deserves more attention. JPMI didn’t identify the laptops that were dropped off, beyond simply saying they were three MacBook Pros.

JPMI doesn’t claim to have paperwork tying a serial number to any of these three laptops until the FBI put one, for the laptop given to the FBI, on a subpoena in December 2019.

JPMI doens’t claim to have proof that the laptop he would go on to give to the FBI — some of the contents of which he shared with Rudy Giuliani who then shared it with half the world, including the NY Post  — was the laptop he claims someone dropped off on April 12, 2019.

Normally, that would not be a big deal. But, as described in his book, the laptop he gave the FBI does not match any of the three laptops he claims were dropped off on April 12, 2019.

One at a time, I performed a quick inspection of the machines. The fifteen-inch laptop was a complete write-off. It had extensive liquid damage, and because the drive was soldered to the logic board, data recovery was beyond my capability. (If a Mac can’t power on, you won’t be able to access the drive and get to the data.)

The thirteen-inch 2015 MacBook Pro was in slightly better shape. It could boot up, but the keyboard was unresponsive. I pulled out an external keyboard and asked for permission to log in.

[snip]

I moved on to the last Mac, a thirteen-inch 2016 MacBook Pro. The drive was soldered onto the logic board. This one powered on but then would shut down. I suspected that there was a short in the keyboard or trackpad, and if I took it apart, I could at least get it to boot and possibly recover the data.

JPMI described three machines:

  • A 15″ laptop, of unknown date, with soldered drive
  • A 13″ laptop from 2015
  • A 13″ laptop from 2016 with a soldered drive

By description, JPMI claims the last one is the one he gave to the FBI.

Based on the serial number, the laptop turned over to the FBI is a 13-inch 2017 PowerBook purchased in October 2018 (the October 2018 purchase date is consistent when it was added to Hunter’s Apple account).

It can’t be the first laptop described here, because it’s a 13″ PowerBook, but it’s a different year — 2017 rather than 2015 or 2016 — than both the 13″ PowerBooks JPMI described.

The difference in year might be no big deal.

The other description JPMI gives about the laptop he claims to be the one he recovered is: According to several people who’ve checked, the laptop shared with the FBI has a removable hard drive.

The entire reason why JPMI claims to have copied the files in the manner he did — by dragging-and-dropping files — is because he didn’t have ports to plug both a keyboard, power, and a cable to his own server. Instead, he plugged in the server and a keyboard, and did the drag-and-drop in three passes, recharging the battery between each pass.

That’s what, he claims, led him to look at Hunter’s files more closely, starting with dick pics and moving onto an “income” document conveniently marked with a purple dot.

Finally, I went in the back to check on Hunter’s liquid-damaged MacBook Pro. It had powered off, dying overnight during the file transfer. I now realized that this was not going to be a simple drag-and-drop procedure. There was about three hundred gigabytes’ worth of data, but not enough charge in the battery to do it all in one go. I started to charge the unit again, planning to give it a couple of hours before making a second attempt. But I also decided to see what had been successfully transferred to the server, praying I didn’t have to start all over again.

[snip]

I changed the folder view to a columns view, to see the files and folders in an alphabetical list. Clicking on a folder in the list opens up a new column with the contents of the folder, and clicking on a file in that column brings up a preview of the file. Eventually, in two separate windows, I would be able bring up both the original desktop and what I had copied, compare them, and transfer the missing files to the recovery window. But first I had to wait until there was enough of a charge in the battery to power on the Mac and keep it on.

[snip]

Here’s where things started to get interesting.

The previous recovered window was open on the left, and I was waiting for the hundreds of files on the original to populate to the right. Scrolling down, I started to see files that didn’t align. I started to individually drag and drop the files to the recovery folder. It took only a few files before I noticed pornography appearing in the right column.

[snip]

I continued copying files until I got to one titled “income.pdf.” I likely wouldn’t even have noticed it if it hadn’t been tagged with a purple dot. On a Mac, you can apply tags, or color codes, to files as an organizational aid. It seemed odd that someone who clearly had zero organizational skills would bother tagging this one file purple. It was begging to be clicked open. So I did.

But once JPMI realized the battery was draining, he could have simply swapped the hard drive into a separate laptop, with functioning keyboard, to copy the files that way.

Indeed, that seems to be (per Gary Shapley’s notes) what the FBI did: just put the hard drive in a new laptop.

FBI determined in order to do a full forensic review a replacement laptop had to be purchased so the hard drive could be installed, booted and imaged.

[snip]

c. Lesley said (while laughing) that because a lot of p[e]op[l]e are going to be asking for the laptop

d. Josh Wilson stated that (while laughing) so whoever they are they are going to have to buy a laptop to put the hard rive in so they can read it [fixed errors in people]

Once you understand the laptop had a removable drive, then JPMI’s excuse for snooping in Hunter’s private files disappears.

But here’s why I can’t stop thinking about the fact that JPMI has no proof of which laptops he received and the laptop described in his book doesn’t match the one he shared with the FBI. One explanation for this discrepancy is ineptitude: during the entire period he was writing the book, he never even consulted the subpoena (the data for which he had provided the FBI). Another is he needed to invent an excuse, after the fact, to explain why he was reading Hunter’s stuff.

But there’s one other potentially related issue.

There aren’t three laptops. There are at least four.

The fourth is the laptop found at Keith Ablow’s in 2020, the one reportedly discovered after Hunter Biden left in February 2019. That laptop is reportedly one that Hunter first signed onto on September 1, 2018, at 10:34AM PDT, also a 13″ MacBook Pro, but one with a touch bar. The next day, Apple emailed Hunter to tell him he had gotten a new laptop — something that didn’t happen for many of his other new devices (including the one that first accessed his iCloud account in October 2018, the one that would end up with the FBI).

If that’s correct, then Hunter initiated the laptop left at Ablow’s in February 2019 in September 1, 2018. And the laptop ultimately shared with the FBI was initiated on October 21, 2018. Though there were accesses to his iCloud and other accounts from new devices almost every week in this period, there’s no sign at all that the touch bar MacBook (as opposed to one after another iPhone and an iPad) had been lost or inactivated.

And if the activity that packaged up Hunter’s digital life happened on the same laptop that ended up in a computer repair shop in Wilmington, then both would be presumed to be at Ablow’s in the same period in late January to early February. That’s an odd occurrence in the first place, since Hunter was going to get treatment, not to work on his memoir. But it’s also odd that the laptop ultimately shared with the FBI stopped synching on the same day that a laptop — possibly the Ablow one? — was purportedly deleted.

There are two problems with this story. None of the three laptops that JPMI describes receiving is the one shared with the FBI. And there’s not a good explanation for why two Hunter Biden laptops would be at Ablow’s property and why the one presumably in Hunter’s presence would stop synching the same day some other laptop was deleted.

This is all background for another post. But one thing that’s clear is none of the laptops JPMI describes in his book can be the one shared with the FBI. And there’s another laptop out there, which would have been present in the same place and time as the laptop that ultimately was shared with the FBI.

Hunter Biden Accused Rudy Giuliani of Hacking His Data, Not Defamation

/58 Comments/in , , , /by

Ruby Freeman and Shaye Moss’ civil trial against Rudy Giuliani goes to trial tomorrow.

In a number of the scene setters for the trial, people are making claims like this:

In addition to his criminal charges, disbarment proceedings and the lawsuit brought by Freeman and Moss, Giuliani has been sued by various other individuals — including President Joe Biden’s son Hunter — who claim he spread false allegations about them in 2020.

Or this:

He and one of his lawyers are being sued by Hunter Biden for allegedly mishandling the presidential son’s laptop,

Hunter Biden is not suing Robert Costello and Rudy Giuliani for defamation. He’s not suing Robert Costello and Rudy Giuliani for mishandling “his laptop,” which (even if John Paul Mac Isaac and Rudy Giuliani have told the truth about everything) would never have been in Rudy’s possession.

Hunter Biden is suing the former President’s former personal lawyer and that lawyer’s former personal lawyer for hacking his data. Hunter Biden is suing Rudy for violating the criminal Computer Fraud and Abuse Act: for accessing a computer without authorization or exceeding authorized access.

41. Defendants have violated the CFAA, specifically section 1030(a)(2)(C) of
the CFAA, by intentionally accessing a computer without authorization or exceeding
authorized access, and thereby obtaining information from any protected computer
which, pursuant to the CFAA, is a computer used in or affecting interstate commerce
or communication.

42. Defendants have violated the CFAA, specifically section 1030(a)(4) of the
CFAA, by knowingly and with intent to defraud, accessing a protected computer
without authorization or exceeding authorized access, and by means of such conduct
furthering the intended fraud and obtaining one or more things of value.

We will have to wait to see whether he can prove that claim. But particularly given that Hunter has since been charged with 12 criminal charges by a US Attorney appointed by Trump, let’s be clear what the claim is.

Hunter Biden has accused Rudy Giuliani of violating the criminal hacking statute.

One reason people make this mistake all the time — on top of the non-stop Fox News propaganda about this — is they think of the laptop like this:

The laptop, as it was brought to John Paul Mac Isaac’s shop, is better thought of like this.

There were dick pics on the laptop (I’m using artistic license in my choice of dick pics).

There were emails, including emails hosted by Google and emails tied to Hunter Biden’s iCloud account. But the laptop also included on it the means to get into Hunter’s iCloud account and at least some of his Google accounts.

There were other digital keys on the laptop and probably enough bank data to get into financial accounts.

And there was the contents of an iPhone, stored in encrypted form. As I’ve described, I first went down this rabbit hole — the entire Hunter Biden rabbit hole — when I read Gary Shapley’s description that the FBI needed a password to access some of the content, the content from the phone, on what was an actual laptop. That’s when I realized that anyone who accessed the encrypted contents of that phone without a warrant might be at risk for CFAA charges.

Several of the people who’ve been offering up Hunter Biden data confess, openly, that they broke the encryption on that phone.

In other words, no matter how all that stuff got put onto Hunter’s laptop, and no matter how it got brought to John Paul Mac Isaac’s shop, and no matter whether JPMI was perfectly in his legal rights to take possession of the laptop itself — all things that are very much contested — the laptop included the means to get into other data, data hosted in the cloud, to which neither JPMI nor anyone else had authorized access.

And then the blind computer repair man, after having chosen to copy that hard drive that, contrary to his claims was a removable hard drive, by cutting and pasting it and reading it along the way, packaged that all up on a hard drive and sent it, without Hunter’s consent, to the then-President’s lawyer.

We don’t know what kind of hard drive JPMI used — he said he constructed his own, to make it untraceable.

Instead of buying external drives from a local store, where the purchase might be traced back to me, or online, which also could be traced and moreover might lead to damage in transit, I built my own.

It took about a week to collect all the pieces and clone the drive from the store’s backup server. In essence, I created a copy that was as close to the original drive as possible.

As I have shown, at a time when Rudy says he (or Robert Costello) were in possession of that hard drive that had on it means to access several of Hunter’s cloud accounts, an email Hunter sent in 2016 was resent, showing some alterations.

Hunter Biden is not accusing Rudy Giuliani of saying things about him that aren’t true. Hunter Biden is accusing Rudy Giuliani of accessing data — whether on a hard drive copied from a laptop or in the cloud — to which he did not have legal access.

John Paul Mac Isaac’s Undisclosed Home Movie

/78 Comments/in , /by

If John Paul Mac Isaac, the legally blind computer repairman who claims Hunter Biden abandoned a laptop at his repair shop, had had his way — at least as he tells the story in his book — he would have obtained video of a single FBI agent sitting on the white couch in his living room, accepting printed copies of certain documents that, JPMI would have narrated for the camera, showed Mykola Zlochevsky in direct contact with senior people in the Obama Administration and implicated Ihor Kolomoyskyi in some vague way.

I printed out a few emails mentioning Ihor Kolomoyskyi. He was on the run with the lion’s share of the billions embezzled from the IMF and Ukraine. He would be the most dangerous person involved if he had an axe to grind. I also included emails from Mykola Zlochevsky and Vadym Pozharskyi showing their access to high levels of the Obama administration.

According to the timeline in JPMI’s book, that exchange would have taken place on November 19, 2019, just as Democrats prepared impeachment.

According to the timeline memorialized by Gary Shapley, however, that first in-person meeting between FBI agents and JPMI happened on November 7, 2019, before the first public impeachment hearing. The timing matters, somewhat, given that JPMI’s book claims his decision to share the “Hunter Biden” laptop with the FBI was a response to impeachment. Using the FBI timeline, it would have anticipated much of it.

More importantly, the discrepancy raises questions about why JPMI would focus on the emails he claims to have.

For example, there are only a few email threads mentioning Kolomoyskyi in the public set of emails from the drive. One is a thread from former Bush official Frank Mermoud passing on a piece about parliamentary maneuverings in Ukraine that mentioned Kolomoyskyi alongside Paul Manafort’s backer, Rinat Akhmetov. Another includes a discussion about how to respond to questions from reporter James Risen, to which Vadym Pozharskyi was adamant that, “The role of Igor Kolomoyskyi is often misunderstood. He has never been involved with Burisma and certainly is not today.” Risen wrote about the resulting story the day the whistleblower transcript was released in September 2019. Hunter Biden was included on both threads, but did not comment. Hunter received a third email via BCC: a link to a New Yorker story about efforts to reform Ukraine after Maidan.

Those are the kind of emails that JPMI would have handed to the FBI on camera, as if they were a smoking gun.

I’m not aware there are any threads from Zlochevsky. There are, of course, a ton about him involving Pozharskyi. And Pozharskyi’s the one who came closest to having any contacts directly with Obama officials, including Hunter’s father. But three years after NYPost published what has been deemed one of the most damning emails, in which Pozharskyi thanked Hunter for, “inviting me to DC and giving an opportunity to meet your father,” the best explanation for the “meeting” is that the Burisma executive attended a World Food Program dinner to which then-Vice President Biden stopped in, ostensibly to visit another attendee. The discussion, per Devon Archer, was about food security, not gas deals.

Nevertheless, JPMI describes that he told the FBI that the emails he had printed out showed Kolomoyskyi, along with Zlochevsky, using Hunter and his business partner to protect their stolen billions.

“This is information about Ihor Kolomoyskyi and Mykola Zlochevsky, and their involvement in using Hunter and Devon to protect the billions they embezzled from the IMF. I am afraid they would silence me for what I know,” I explained, sliding the paperwork across the table toward the two agents.

In other words, had JPMI’s set-up worked, the video showing the handoff would have been far more scandalous than the emails themselves have proven to be, particularly if it had come out just as Democrats moved to impeach Trump for demanding dirt on Hunter Biden. And it would have focused far more closely on Kolomoyskyi than the laptop contents justified.

It would have done what Republicans, to this day, demand should have happened: public notice that the “laptop was real.” It still doesn’t matter what is on that damn thing: it’s a shiny object, just like John Podesta’s risotto recipe, and Republicans know that’s all their followers need.

This was JPMI’s self-described plan for sharing the laptop with the FBI: It wasn’t so much that he wanted to hand off the laptop. He wanted to create a video of the FBI accepting paper copies that he claimed were something they weren’t.

As JPMI describes it, his plans to create such a video failed because, first of all, FBI agents always travel in twos, in part to ensure there are always two witnesses to conversations like this. One of the two agents coming to interview JPMI noticed and pointed to the camera the computer repairman had just installed in advance of the interview, so both agents chose to sit in a smaller loveseat, leaving JPMI facing his own camera.

I shut the door behind them and then closed the second, interior door. I saw Agent DeMeo point to the camera on the shelf, and the two sat down on the loveseat.

“Not a great start,” I thought, sitting on the couch facing the camera.

To my knowledge, such video has never been publicly released, perhaps because the agents also declined to take the documents with them when they left. But JPMI’s claim to have taken video, while it may explain the clarity with which he remembers telling the FBI he had documents implicating Hunter Biden in helping Kolomoyskyi, “protect the billions [he] embezzled from the IMF,” raises still more questions about the discrepancy between his timeline and FBI’s.

I reviewed JPMI’s description of his attempt to film the FBI agents as they picked up emails that don’t say what JPMI claimed they did, along with the discrepancies between JPMI’s claimed timeline and FBI’s, after I revisited how Rudy’s alleged efforts to extort legal relief for dirt transpired. That piece showed that Rudy’s efforts to find dirt — in 2019, ostensibly a year before JPMI first contacted him — parallel the JPMI timeline in interesting ways.

Rudy’s public, failed attempt to obtain dirt from Kolomoyskyi makes JPMI’s inexplicable treatment of the one-time Volodymyr Zelenskyy funder, to whose corruption JPMI dedicates a 3-page description elsewhere in his book, more interesting. Kolomoyskyi’s role in events leading up to impeachment is real. Lev Parnas has receipts from his trip to Israel in a failed bid to extort dirt from Kolomoyskyi, after which Rudy called out Kolomoyskyi publicly.

But there’s no reason for Kolomoyskyi to be in JPMI’s book, especially given JPMI’s admission, when trying to disclaim responsibility for the money laundering case number that appeared on the subpoena, that Hunter had no role in Kolomoyskyi’s corruption.

Agent DeMeo was based in Baltimore, but he’d never said anything about money laundering. The only discussion about anything remotely close to money laundering revolved around Ihor Kolomoyskyi and his Delaware assets. I remember discussing that, but it hadn’t involved Hunter Biden.

Whatever emails he printed out would have done little to substantiate the specific corruption claims he, by his own telling, made to the FBI. But JPMI claims that he tried to put them in his video as a prop anyway.

The first time I examined discrepancies between JPMI’s story and the one memorialized by Shapley, I had noted how a shift in JPMI’s timeline served to support his explanation that he shared the laptop with the FBI in response to impeachment. He described packaging up specific emails from the laptop to excuse Trump’s call with Volodymyr Zelenskyy (JPMI dates his own trolling of the laptop to this WaPo article, just days before the perfect phone call).

And of course I included the smoking gun, the one that could put an immediate end to this bogus impeachment: the initial email outlining Devon and Hunter’s plan to use Vice President Biden as the centerpiece of their plan to tap into the billions Burisma had to offer. The shady business dealings I had witnessed on the laptop, in my opinion, justified President Trump’s phone call with Zelenskyy.

But as I’ve focused more closely since, a more interesting discrepancy is that JPMI claims his father first reached out to the FBI on October 9 — around seven hours before Lev Parnas was arrested on his way to get a laptop in Vienna — whereas the FBI claims it happened on October 16, a week later. Normally, you’d trust the FBI’s timeline over JPMI’s.

But the blind computer repairman claims to have written Rudy a letter, the night before his father planned to go to the FBI. In the letter, JPMI explained his plan, in case anything bad happened. JPMI describes packaging this up on October 8 and giving it to a friend, Kristin, for safekeeping.

My father called the next morning. His plan was to visit the FBI field office in Albuquerque around 10 a.m. the next day.

From there on out, I would have to be extra careful. After his visit, people beyond those we trusted would know of the laptop’s existence, introducing a whole new element of potential danger. For my safety net, I had to make sure to write Rudy Giuliani an attention-getting letter. I definitely didn’t want to come off as a nutjob or conspiracy junkie. The letter would have to be clear and to the point, explaining my actions leading up to my father’s FBI interaction without revealing his identity. I wanted to focus on my reasons for not trusting the FBI as well as my expectations for what could happen. More important, I wanted to let Giuliani know why, if he were reading the letter, I would need his help. Here’s what I came up with.

Rudolph Giuliani

Giuliani Security and Safety

Sir,

If you have received this letter, I am in need of your help. Last April 12, Hunter Biden came into my Mac repair shop in Wilmington, Delaware, requesting data recovery from 3 of his laptops. I was able to check in the one working Mac and accomplished a data recovery. He has failed to return to pay or collect the recovered data or his laptop. As the events of the summer unfolded, and after the shop’s 90 day abandonment policy expired, I decided to poke around and look to see if there was anything topical on his drive. I discovered enough information that I no longer felt comfortable being in possession of his data and laptop. I decided that I wanted to turn over everything I have to the FBI or local police, but a major concern was what if compromised FBI or local police intercepted the data and destroyed it, preventing it from ending up in the hands of someone who can use it. I could not risk contacting anyone local so I mailed a copy of the drive out of state to a trusted person who would contact the FBI on Wednesday, October 9, and if trustworthy FBI were contacted, they were instructed to collect the laptop and data from my shop discreetly. If you are reading this letter, it means the compromised FBI has collected the laptop, data and possibly me. I have included a flash drive with some emails and files recovered from his laptop that could be useful in your investigation. If I am in the compromised FBI’s custody, it means that there are still members of the FBI who are working to protect a former Vice-President and silence those who provide proof to his corruption. I need your help, not just to get out of custody, but also to bring to light what has happened. I have included a full copy of the laptop on an external drive. You will need a Mac to access it.

Thank you for your time and help.

John Paul Mac Isaac [my emphasis]

According to this timeline, JPMI asked Kristin if she was willing to hold a copy of the drive sometime between September 24 and October 8. Then he wrote and printed out the letter on October 8, the day before his father would go to the FBI. After 7PM that day, he packaged up the drive, the letter, and “a flash drive consisting of documents summarizing the Bidens’ criminal activity” in a 5″X7″ padded envelope, and walked the package out to Kristin’s house in a residential area of Wilmington.

In August 2020, after JPMI reached out to Rudy and then spoke with Robert Costello, there were (per his book anyway), three versions of the hard drive, on top of what he had given the FBI: A copy he had kept and made a bunch of notes on, a copy in his uncle’s possession, and the copy he had given to Kristen for safe keeping — a copy that should have been in an envelope with a thumb drive with documents saved almost a year before.

That last drive is the one he sent to Robert Costello.

“Let me tell you about the Department of Justice,” Bob said. “When Rudy and I returned from Ukraine last year, we submitted over two hundred subpoena requests to the district attorney, and not a single one has been filed. Do you know what the term ‘slow walking’ means?” I said no.

“It’s when they deliberately drag their asses to delay or even prevent a case from moving forward,” he supplied. “That’s what the DOJ is doing to us, and that is what the FBI is doing to you. How quickly can you get me a copy of the drive?”

“I can drop something in the mail for you tomorrow.”

“Let me call you back in a few minutes,” Bob said. “Will you be around?” I said yes, and we hung up.

That wasn’t so bad! I had their attention, and it felt like I was talking to the right person. At this point I realized I needed a copy of the drive. My copy had all my notes, and because of this I felt it would be considered tampered with. My uncle Ron had the copy that originally had been in my father’s possession. That was too far away.

Then I smiled, remembering that the other copy I’d made back then had ended up with Kristen, and she was to hand-deliver it to Rudy Giuliani if all else failed. It was kind of funny that I could have saved myself nearly a year if I had just gone to him in the first place.

Bob called me back, and we agreed I would FedEx the drive to him the next day.

[snip]

When we hung up, I dialed Kristen.

She answered quickly. “Is everything OK?” she asked. “What’s wrong?”

“Everything is OK,” I said, then amended that: “I think everything is going to be OK. I hope it’s not too late. I need to come over and grab something.”

August 28, 2020

I dropped the drive off at FedEx the next morning on my walk to work. It was done. The drive was on its way to the lawyer of the president. My work was done; I’d seen it through to the end.

Unless he repackaged it, the flash drive would have been sent along with the hard drive.

That flash drive with a few documents on it is one of the best explanations for the metadata on the documents shared with NYPost a year later. One, of a detailed email Hunter wrote about how Burisma should navigate the likely election of Poroshenko which noted Vice President Biden’s upcoming trip but which also recorded Hunter stating, “they need to know in no uncertain terms that we will not and cannot intervene directly with domestic policy makers, and that we need to abide by FARA and any other US laws in the strictest sense across the board,” has metadata reflecting a creation data on September 28, 2019, right in the period where, JPMI describes, he and his father were developing their plan.

Another document published by NYPost on October 14, 2020, an email in which Vadym Pozharskyi emailed Devon Archer and Hunter asking them to “use your influence to convey a message / signal, etc to stop using what we consider politically motivated actions” to prosecute Burisma (which led to a real effort to intervene on their part, albeit one carried out through paid lobbyists), has metadata showing a creation date of October 10, 2019 — after JPMI says he had already dropped off an envelope that would remain untouched for almost a year.

There are a bunch of other possible explanations for this metadata. But according to JPMI’s book, there would be documents saved to flash drive on or before October 8, then packaged up for a year.

But not after October 10.

True, JPMI accessed a similar set of emails again in the subsequent weeks, in preparation for his staged meeting with the FBI. But he describes those exclusively as printouts.

Ultimately, these are just weeds, inconsistent metadata that could either reflect sloppiness or could be intentional manipulation.

But they provide an interesting background to inconsistencies in the rest of JPMI’s story.

Bret Baier’s False Claim, the Escort Service, and Former Fox News Pundit Keith Ablow

/86 Comments/in , , , /by

Deep into one version of what is referred to as the “Hunter Biden” “laptop,” (according to reports done for Washington Examiner by Gus Dimitrelos*) there’s a picture of a check, dated November 14, 2018, for $3,400, paid to a woman with a Slavic name. The check bears a signature that matches others, attributed to Hunter Biden, from the “laptop” also attributed to him. Along with a line crossing out Hunter’s ex-spouse’s name on the check, the check was marked on the memo line: “Blue Water Wellness” along with a word that is illegible–possibly “Rehab.”

The check appears in a chat thread, dated November 26, 2018, apparently initiated to set up tryst with an escort in New York  City. Just over 12 hours after setting up that tryst, the Russian or Ukrainian woman who manages the escort service, Eva, wrote back, asking Hunter if he was in New York, because she had a problem with his check, that $3,400 check dated twelve days earlier. Hunter was effusively apologetic, and offered to pay the presumed sex worker via wire, because it’s the only way he could be 100% certain it would get to her. Shortly thereafter, he sent two transfers from his Wells Fargo account, $3,200 plus $30 fees, directly to the woman’s bank account, and $800 via Zelle drawn on Wells Fargo.

Those transfers from Hunter Biden’s Wells Fargo account to a presumed sex worker with a Slavic name took place between the day, October 31, 2018, when IRS Agent Joseph Ziegler, newly arrived on IRS’ international tax squad, launched an investigation into an international online sex business and the day, December 10, 2018, when Ziegler would piggyback off that sex business investigation to launch an investigation into Hunter Biden. The Hunter Biden investigation was initially based off a Suspicious Activity Report from Wells Fargo sent on September 21, 2018 and from there, quickly focused on Hunter’s ties to Burisma, precisely the investigation the then President was demanding.

Understand: The entire five year long investigation of Hunter Biden was based off payments involving Wells Fargo quite similar to this one, the check for $3,400 to a sex worker associated (in this case, at least) with what Dimitrelos describes as an escort service.

Research on the company yielded bank reports indicating that [Hunter Biden] made payments to a U.S. contractor, who also had received payments from that U.K. company.

Only, this particular payment — the need to wire the presumed sex worker money to cover the check — ties the escort service to one of the businesses of former Fox News pundit Keith Ablow: Blue Water Wellness, a float spa just a few blocks down the road from where Ablow’s psychiatric practice was before it got shut down amid allegations of sex abuse of patients and a DEA investigation. Emails obtained from a different version of the “laptop” show that on November 13, Blue Water Wellness sent Hunter an appointment reminder, albeit for an appointment on November 17, not November 14. That appointment reminder is the first of around nine appointment reminders at the spa during the period.

The tryst with the presumed sex worker with the Slavic name does appear to have happened overnight between November 13 and 14.  Between 1:58 and 6:33AM, there were two attempts to sign into Hunter’s Venmo account from a new device, five verification codes sent to his email, and two password resets, along with the addition of the presumed sex worker to his Zelle account at Wells Fargo, which he would use to send her money over a week later. All that makes it appear like they were together, but Hunter didn’t have his phone, the phone he could use to pay her and so tried to do so from a different device. Maybe, he gave up, and simply wrote her a check, from the same account on which that Zelle account drew.

None of which explains why he appears to have written “Blue Water Wellness” on a check to pay a presumed sex worker. Maybe he was trying to cover up what he was paying for. Maybe he understood there to be a tie. Or maybe it was the advertising Blue Water did at the time.

Deep in a different part of the laptop analyzed by Dimitrelos, though, a deleted invoice shows that Hunter met with former Fox News pundit Keith Ablow on the same day as Hunter apparently wrote that check to the presumed sex worker. The deleted invoice reflects two 60-minute sessions billed by Baystate Psychiatry, the office just blocks away from the float spa.

Emails obtained from a different version of the “Hunter Biden” “laptop” show that at some point on November 26, 2018, as Hunter first arranged a tryst in New York City and then, no longer in New York, sent a wire directly from Wells Fargo to the presumed sex worker, someone accessed Hunter’s Venmo account from a new device — successfully this time — one located in Newburyport, MA, where former Fox News pundit Keith Ablow’s businesses were.

There are a number of things you’d need to do to rule out the possibility of Russian involvement in the process by which a laptop purportedly belonging to Hunter Biden showed up at the Wilmington repair shop of John Paul Mac Isaac, from there to be shared with Rudy Giuliani, who then shared it with three different Murdoch outlets and a ton of other right wing propagandists, many of them members of Congress.

One of those would be to rule out that any of the sex workers tied to this escort service had a role in compromising Hunter Biden’s digital identity, thereby obtaining credential information that would make it easy to package up a laptop that would be especially useful to those trying to destroy the life of the son of Donald Trump’s opponent. There’s no evidence that any of the sex workers were involved, but throughout 2018, there are a number of device accesses involving Hunter’s Venmo account, the iCloud account packaged up on “the laptop,” and different Google accounts — including between the day on November 13 when Hunter appears to have met the woman with the Slavic name and the date on November 26 when he wired her money — that should at least raise concerns that his digital identity had been compromised. I’ve laid out just a fraction of them in this post and this post, both of which focus on the later period when Hunter was in the care of the former Fox News pundit.

If you wanted to compromise Hunter Biden, as certain Russian-backed agents in Ukraine explicitly did, doing so via the sex workers, drug dealers, and fellow junkies he consorted with in this period would be painfully easy. Indeed, in Hunter’s book, he even described other addicts walking off with his, “watch or jacket or iPad—happened all the time.” Every single one of those iPads that walked away might include the keys to Hunter’s digital life, and as such, would be worth a tremendous amount of money to those looking to score their next fix. To rule out Russian involvement, you’d have to ID every single one of them and rule out that they were used for ongoing compromise of Hunter or, barring that, you’d have to come up with explanations, such as the likelihood that Hunter was trying to pay a sex worker but didn’t have his phone with him and so used hers, for the huge number of accesses to his accounts, especially the iCloud account ultimately packaged up.

Of course, explaining how a laptop purportedly belonging to Hunter Biden showed up at Mac Isaac’s shop would also require explaining how a laptop definitely belonging to Hunter Biden came to be left in former Fox News pundit Keith Ablow’s possession during precisely the same period when (it appears) Hunter Biden’s digital life was getting packaged up, a laptop Ablow did nothing to return to its owner and so still had when the DEA seized it.

Bret Baier lied about the Hunter Biden laptop

Given the unanswered questions about the role of a former Fox News pundit in all this, you’d think that Fox personalities would scrupulously adhere to the truth about the matter, if for no other reason than to avoid being legally implicated in any conspiracies their former colleague might have been involved with, or to avoid kicking off another expensive defamation lawsuit.

Sadly, Bret Baier couldn’t manage to stick to the truth in his attempt to sandbag former CIA Director Leon Panetta on Friday. Baier debauched the gravity of an appearance purportedly focused on the Hamas attack and aftermath,  with what he must have thought was a clever gotcha question about a letter Leon Panetta signed in October 2020 stating the opinion that the emails being pitched by Murdoch outlet New York Post, “has all the classic earmarks of a Russian information operation.” The letter not only expressed an opinion, but it cited four specific data points and two observations about known Russian methods, all of which were and remain true to to this day.

And in the process, Bret Baier made a false claim.

Bret Baier made a false claim and all of Fox News’ watchers and all the other propagandists made the clip of Bret Baier making a false claim go viral, because they apparently either don’t know or don’t care that Baier couldn’t even get basic facts right. They are positively giddy that Baier used the tragedy of a terrorist attack to demonstrate his own ignorance or willful deceit about Fox’s favorite story, Hunter Biden’s dick pics.

From the get-go, Baier adopted a rhetorical move commonly used by Murdoch employees and frothy right wingers sustaining their blind faith in “the laptop:” He conflated “the laptop” with individual emails.

Baier: I’d be remiss if I didn’t ask you about that letter you signed onto from former intelligence officials saying that the laptop and the emails had all the classic earmarks of a Russian information operation. Obviously the New York Post and others saying the Hunter Biden letter was the real disinformation all along. Um, that letter was used in the debate, I haven’t asked you this. But do you have regrets about that, now looking back, knowing what you know now? [my emphasis]

The spooks’ letter Panetta signed addressed emails, not “the laptop.” The only use of the word “laptop” in the letter was in labeling this a potential “laptop op,” a way to package up emails meant to discredit Joe Biden. The letter even includes “the dumping of accurate information” among the methods used in Russian information operations.

Having conflated emails and “the laptop,” Baier then asked whether Panetta thinks “it,” now referring just to “the laptop,” not even the hard drives of copies from the laptop in question, was real.

Panetta: Well, you know, Bret, I was extremely concerned about Russian interference and misinformation. And we all know it. Intelligence agencies discovered that Russia had continued to push disinformation across the board. And my concern was to kind of alert the public to be aware that these disinformation efforts went on. And frankly, I haven’t seen any evidence from any intelligence that that was not the case.

Baier: You don’t think that it was real?

Having first conflated emails and the laptop, then substituted the laptop for the emails addressed in the letter, Baier then falsely claimed that, “Hunter Biden said it was his laptop.”

Panetta: I think that, I think that disinformation is involved here. I think Russian disinformation is part of what we’re seeing everywhere. I don’t trust the Russians. And that’s exactly why I was concerned that the public not trust the Russians either.

Baier: I don’t want to dwell on this because we have bigger things to talk about. Bigger urgency. But obviously, Hunter Biden said it was his laptop, and this investigation continues. [my emphasis]

I understand how frothy right wingers misunderstand what Hunter Biden has said about the data associated with “the laptop,” but Baier presents as a journalist, and you’d think he’d take the time to read the primary documents.

Hunter Biden admits some data is his, but denies knowledge of the “laptop”

The claim that Hunter Biden has said “the laptop” was his arises from three lawsuits: first, from Hunter Biden’s response and counterclaim to John Paul Mac Isaac’s lawsuit, then of Hunter’s lawsuit against Garrett Ziegler, and finally, the lawsuit against Rudy Giuliani.

Regarding the first of those filings, Hunter Biden based his countersuit against JPMI on an admission that JPMI came into possession of electronically stored data, at least some of which belonged to him. But he specifically did not admit that JPMI “possessed any particular laptop … belonging to Mr. Biden.”

5. In or before April 2019, Counterclaim Defendant Mac Isaac, by whatever means, came into possession of certain electronically stored data, at least some of which belonged to Counterclaim Plaintiff Biden.1

1 This is not an admission by Mr. Biden that Mac Isaac (or others) in fact possessed any particular laptop containing electronically stored data belonging to Mr. Biden. Rather, Mr. Biden simply acknowledges that at some point, Mac Isaac obtained electronically stored data, some of which belonged to Mr. Biden.

Regarding JPMI’s claims that Hunter dropped off the laptop,

169. HUNTER knowingly left his laptop with Plaintiff on April 12, 2019.

170. Soon thereafter HUNTER returned to Plaintiff’s shop to leave an external hard drive to which Plaintiff could transfer the data from HUNTER’s laptop.

171. HUNTER never returned to Plaintiff’s shop pick up his laptop

Hunter denied sufficient knowledge to answer all of them.

169. Mr. Biden is without knowledge sufficient to admit or deny the allegations in paragraph 169.

170. Mr. Biden is without knowledge sufficient to admit or deny the allegations in paragraph 170.

171. Mr. Biden admits that, if he ever had visited before, he did not return to Plaintiff’s shop.

In response to JPMI’s claim that Hunter knew of the phone call his lawyer, George Mesires, made to JPMI in October 2020 and the email follow-up that in any case doesn’t substantiate what JPMI claimed about the phone call,

31. On October 13, 2020, Plaintiff received a call from Mr. George Mesires,1 identifying himself as HUNTER’s attorney, asking if Plaintiff still had possession of his client’s laptop and following up thereafter with an email to the Plaintiff. Copy of email attached as EXHIBIT C.

[snip]

174. HUNTER’s attorney, George Mesires contacted Plaintiff on October 13, 2020 about the laptop.

Hunter admitted that Mesires was his attorney but denied knowing anything more.

31. Mr. Biden admits that Mr. George Mesires was his attorney. Mr. Biden is without knowledge sufficient to admit or deny the remaining allegations in paragraph 31.

[snip]

174. Mr. Biden admits that Mr. Mesires was his attorney. Mr. Biden is without knowledge sufficient to admit or deny the remaining allegations in paragraph 174.

In response to JPMI’s claim that Hunter Biden said something about the laptop without mentioning JPMI,

172. When asked about the laptop in a television interview broadcast around the world, HUNTER stated, “There could be a laptop out there that was stolen from me. It could be that I was hacked. It could be that it was the – that it was Russian intelligence. It could be that it was stolen from me. Or that there was a laptop stolen from me.” See https://edition.cnn.com/2021/04/02/politics/hunterbiden-laptop/index.html.

173. HUNTER knew it was his laptop.

Hunter Biden admitted he made the comment that didn’t mention JPMI — a comment on which JPMI based a $1.5M defamation claim!! — but again denied knowing whether or not the laptop was his.

172. Admitted and Mr. Biden further answers that the statement makes no mention of or even a reference to Plaintiff.

173. Mr. Biden is without knowledge sufficient to admit or deny the allegations in paragraph 173.

Of some interest, in response to JPMI’s claim that the information that appeared in the NYPost came from Hunter, who voluntarily left his laptop with JPMI,

67. The information contained in the NY POST exposé came from HUNTER who voluntarily left his laptop with the Plaintiff and failed to return to retrieve it.

Hunter outright denied the claim.

67. Denied.

Hunter Biden claimed that Rudy hacked Hunter’s data

That last claim — the outright denial that the data in the NYPost story came from Hunter — is of particular interest given something Denver Riggleman recently said. He described that the Hunter Biden team now has the data that JPMI shared with others — apparently thanks to this countersuit — and they’ve used it to compare with the data distributed forward from there.

Also, we know now, since the Hunter Biden team has the John Paul Mac Isaac data that was given to Rudy Giuliani and given to CBS, we also know that that data had no forensic chain of custody and it was not a forensic copy of any type of laptop, or even multiple devices that we can see. It was just a copy-paste of files, more or less.

[snip]

We know that there’s different data sets in different portions of the Internet attributed to Hunter’s data — or, to Hunter’s laptop.

[nip]

Now that we do have forensic data — Hunter Biden team has more foensic data than anybody else out there — we can actually start to compare and contrast. And that’s why you see the aggressiveness from the Hunter Biden legal team.

The lawsuit against Rudy and Costello claims that at some point, Rudy and Costello did things that amount to accessing Hunter’s data unlawfully. Hacking.

23. Following these communications, Mac Isaac apparently sent via FedEx a copy of the data he claimed to have obtained from Plaintiff to Defendant Costello’s personal residence in New York on an “external drive.” Once the data was received by Defendants, Defendants repeatedly “booted up” the drive; they repeatedly accessed Plaintiff’s account to gain access to the drive; and they proceeded to tamper with, manipulate, alter, damage and create “bootable copies” of Plaintiff’s data over a period of many months, if not years. 2

24. Plaintiff has discovered (and is continuing to discover) facts concerning Defendants’ hacking activities and the damages being caused by those activities through Defendants’ public statements in 2022 and 2023. During one interview, which was published on or about September 12, 2022, Defendant Costello demonstrated for a reporter precisely how Defendants had gone about illegally accessing, tampering with, manipulating and altering Plaintiff’s data:

“Sitting at a desk in the living room of his home in Manhasset, [Defendant Costello], who was dressed for golf, booted up his computer. ‘How do I do this again?’ he asked himself, as a login window popped up with [Plaintiff’s] username . . .”3

By booting up and logging into an “external drive” containing Plaintiff’s data and using Plaintiff’s username to gain access Plaintiff’s data, Defendant Costello unlawfully accessed, tampered with and manipulated Plaintiff’s data in violation of federal and state law. Plaintiff is informed and believes and thereon alleges that Defendants used similar means to unlawfully access Plaintiff’s data many times over many months and that their illegal hacking activities are continuing to this day.

[snip]

26. For example, Defendant Costello has stated publicly that, after initially accessing the data, he “scrolled through the laptop’s [i.e., hard drive’s] email inbox” containing Plaintiff’s data reflecting thousands of emails, bank statements and other financial documents. Defendant Costello also has admitted publicly that he accessed and reviewed Plaintiff’s data reflecting what he claimed to be “the laptop’s photo roll,” including personal photos that, according to Defendant Costello himself, “made [him] feel like a voyeur” when he accessed and reviewed them.

27. By way of further example, Defendant Costello has stated publicly that he intentionally tampered with, manipulated, and altered Plaintiff’s data by causing the data to be “cleaned up” from its original form (whatever this means) and by creating “a number of new [digital] folders, with titles like ‘Salacious Pics’ and ‘The Big Guy.’” Neither Mac Issac nor Defendants have ever claimed to use forensically sound methods for their hacking activities. Not surprisingly, forensic experts who have examined for themselves copies of data purportedly obtained from Plaintiff’s “laptop” (which data also appears to have been obtained at some point from Mac Isaac) have found that sloppy or intentional mishandling of the data damaged digital records, altered cryptographic featuresin the data, and reduced the forensic quality of data to “garbage.”

2 Plaintiff’s investigation indicates that the data Defendant Costello initially received from Mac Isaac was incomplete, was not forensically preserved, and that it had been altered and tampered with before Mac Issac delivered it to Defendant Costello; Defendant Costello then engaged in forensically unsound hacking activities of his own that caused further alterations and additional damage to the data he had received. Discovery is needed to determine exactly what data of Plaintiff Defendants received, when they received it, and the extent to which it was altered, manipulated and damaged both before and after receipt.

3 Andrew Rice & Olivia Nuzzi, The Sordid Saga of Hunter Biden’s Laptop, N.Y. MAG. (Sept. 12, 2022), https://nymag.com/intelligencer/article/hunter-biden-laptop- investigation.html.

I don’t think Hunter’s team would have compared the data Rudy shared with the NYPost before Hunter denied, outright, that “The information contained in the NY POST exposé came from HUNTER.” But based on what Riggleman claimed, they have since, and did compare it, before accusing Rudy and a prominent NY lawyer of hacking Hunter Biden’s data.

Hunter Biden’s team admits they don’t know the precise timing of this: “the precise timing and manner by which Defendants obtained Plaintiff’s data remains unknown to Plaintiff.” DDOSecrets points to several emails that suggest Rudy and Costello did more than simply review available data, however. For example, it points to this email created on September 2, 2020, just after the former President’s lawyer got the hard drive.

September 2, 2020: A variation of a Burisma email from 2016 is created and added to the cache. The email and file metadata both indicate it was created on September 2, 2020.

But the lawsuit, if proven, suggests the possibility that between the time JPMI shared the data with Rudy and the time Rudy shared it with NYPost, Rudy may have committed federal violations of the Computer Federal Fraud and Abuse Act — that is, Hunter alleges that between the time JPMI shared the data and the time NYPost published derivative data, Rudy may have hacked Hunter Biden’s data.

If he could prove that, it means the basis Twitter gave for throttling the NYPost story in October 2020 — they suspected the story included materials that violated Twitter’s then prohibition on publishing hacked data — would be entirely vindicated.

For example, on October 14th, 2020, the New York Post tweeted articles about Hunter Biden’s laptop with embedded images that look like they may have been obtained through hacking. In 2018, we had developed a policy intended to, to prevent Twitter from becoming a dumping ground for hacked materials. We applied this policy to the New York Post tweets and blocked links to the articles embedding those source materials. At no point did Twitter otherwise prevent tweeting, reporting, discussing or describing the contents of Mr. Biden’s laptop.

[snip]

My team and I exposed hundreds of thousands of these accounts from Russia, but also from Iran, China and beyond. It’s a concern with these foreign interference campaigns that informed Twitter’s approach to the Hunter Biden laptop story. In 2020, Twitter noticed activity related to the laptop that at first glance bore a lot of similarities to the 2016 Russian hack and leak operation targeting the dnc, and we had to decide what to do, and in that moment with limited information, Twitter made a mistake under the distribution of hacked material policy.

If Hunter can prove that — no matter what happened in the process of packaging up this data before it got to JPMI, whether it involved the compromise of Hunter’s digital identity before JPMI got the data, which itself would have been a hack that would also vindicate Twitter’s throttling of the story  — it would mean all the data that has been publicly released is downstream from hacking.

For Twitter, it wouldn’t matter whether the data was hacked by Russia or by Donald Trump’s personal lawyer, it would still violate the policy as it existed at the time.

Importantly, this remains a claim about data, not about a laptop. The lawsuit against Rudy and Costello repeats the claim made in the JPMI counterclaim: while JPMI had data, some of which belongs to Hunter, Hunter is not — contrary to Bret Baier’s false claim — admitting that, “Hunter Biden said it was his laptop.”

2. Defendants themselves admit that their purported possession of a “laptop” is in fact not a “laptop” at all. It is, according to their own public statements, an “external drive” that Defendants were told contained hundreds of gigabytes of Plaintiff’s personal data. At least some of the data that Defendants obtained, copied, and proceeded to hack into and tamper with belongs to Plaintiff.1

1 This is not an admission by Plaintiff that John Paul Mac Isaac (or others) in fact possessed any particular laptop containing electronically stored data belonging to Plaintiff. Rather, Plaintiff simply acknowledges that at some point, Mac Isaac obtained electronically stored data, some of which belonged to Plaintiff.

In two lawsuits, Hunter Biden explicitly said that he was not admitting what Baier falsely claimed he had.

I know this is Fox News, but Baier just blithely interrupted a sober discussion about a terrorist attack to make a false claim about “the laptop.”

Hunter Biden claims that Garrett Ziegler hacked Hunter’s iPhone

Hunter Biden’s approach is different in the Garrett Ziegler lawsuit, in which he notes over and over that Ziegler bragged about accessing something he claimed to be Hunter Biden’s laptop, but which was really, “a hard drive that Defendants claim to be of Plaintiff’s ‘laptop’ computer.” By the time things got so far downstream to Ziegler, there was no pretense this was actually a laptop, no matter what Baier interrupted a discussion about terrorism to falsely claim.

But that paragraph explicitly denying admission about this being a laptop is not in the Ziegler suit.

There’s a likely reason for that. The core part of the claim against Ziegler is that Ziegler unlawfully accessed a real back-up of Hunter Biden’s iPhone, which was stored in encrypted form in iTunes — just as I laid out had to have happened months before that lawsuit.

28. Plaintiff further is informed and believes and thereon alleges that at least some of the data that Defendants have accessed, tampered with, manipulated, damaged and copied without Plaintiff’s authorization or consent originally was stored on Plaintiff’s iPhone and backed-up to Plaintiff’s iCloud storage. On information and belief, Defendants gained their unlawful access to Plaintiff’s iPhone data by circumventing technical or code-based barriers that were specifically designed and intended to prevent such access.

29. In an interview that occurred in or around December 2022, Defendant Ziegler bragged that Defendants had hacked their way into data purportedly stored on or originating from Plaintiff’s iPhone: “And we actually got into [Plaintiff’s] iPhone backup, we were the first group to do it in June of 2022, we cracked the encrypted code that was stored on his laptop.” After “cracking the encrypted code that was stored on [Plaintiff’s] laptop,” Defendants illegally accessed the data from the iPhone backup, and then uploaded Plaintiff’s encrypted iPhone data to their website, where it remains accessible to this day. It appears that data that Defendants have uploaded to their website from Plaintiff’s encrypted “iPhone backup,” like data that Defendants have uploaded from their copy of the hard drive of the “Biden laptop,” has been manipulated, tampered with, altered and/or damaged by Defendants. The precise nature and extent of Defendants’ manipulation, tampering, alteration, damage and copying of Plaintiff’s data, either from their copy of the hard drive of the claimed “Biden laptop” or from Plaintiff’s encrypted “iPhone backup” (or from some other source), is unknown to Plaintiff due to Defendants’ continuing refusal to return the data to Plaintiff so that it can be analyzed or inspected. [my emphasis]

Hunter Biden’s team has backup for this assertion, thanks to the notes Gary Shapley took in an October 22, 2022 meeting about what was an actual laptop JPMI handed over to the FBI. On that laptop — which the FBI had confirmed was associated with Hunter Biden’s iCloud account and which it tied to data that could all be falsifiable to someone in possession of the laptop, which had means to intercept and redirect emails and calls to Hunter’s real devices, but which the FBI still had not validated 10 months after obtaining it — the iPhone content was encrypted.

Laptop — iphone messages were on the hard drive but encrypted they didn’t get those messages until they looked at laptop and found a business card with the password on it so they were able to get into the iphone messages [my emphasis]

Even the FBI needed to find a password to access the iPhone content that Ziegler has bragged about accessing. (Note: there have been four known accesses to this data, and every single one of them claims to have used a different means to break the encryption, which in my mind raises real questions about the nature of the business card). But the FBI had a warrant. Ziegler did not.

There are still a great deal of questions one would have to answer before entirely ruling out that Russians were involved in the process of packaging up Hunter Biden’s digital identity; the possible role of a Russian escort service is only one of at least three possible ways Russia might be involved. Yet Bret Baier is unwilling to pursue those questions — starting with the unanswered questions about the role that Baier’s former Fox News colleague played.

But with all those unanswered questions, Baier was nevertheless willing to interrupt a discussion about terrorism to make false claims about what is known.

Update: I’ve taken out that this was specifically a Russian escort service. Some outlets claim Eva is Ukrainian. Dimitrelos does claim that Hunter searched for “Russian escort service,” though.

Update: Added the Bluewater Wellness Intramuscular Injection ad from October 2018.

Update: Added the observation about a newly created email from DDOSecrets.

Update: I was reminded of Bret Baier’s opinion in the same days when Leon Panetta was expressing his doubts about this story.

During a panel on his Thursday evening show, Baier addressed the Post‘s story and the decision by both Twitter and Facebook to limit sharing of the story on their respective platforms because of concerns about spreading misinformation. The move elicited fierce pushback from conservatives and sparked a vote on a Congressional subpoena of Twitter CEO Jack Dorsey.

“The Biden campaign says the meeting never happened, it wasn’t on the schedules, they say,” Baier noted. “And the email itself says ‘set up’ for a meeting” instead of discussing an actual meeting.

Baier then played an audio clip from a SiriusXM radio interview of Giuliani, where he appeared to alter the original details of who dropped off the laptop from which the emails in question were purportedly obtained. The computer store owner who gave a copy of the laptop’s hard drive to Giuliani was also heard explaining how he is legally blind and couldn’t for certain identify just who delivered the computer to him.

” Let’s say, just not sugarcoat it. The whole thing is sketchy,” Baier acknowledged. “You couldn’t write this script in 19 days from an election, but we are digging into where this computer is and the emails and the authenticity of it.”

Featured image courtesy of Thomas Fine.

*As I have noted in the past, Dimitrelos prohibited me from republishing his reports unless I indemnify him for the privacy violations involved. I have chosen instead — and am still attempting — to get permission from Hunter Biden’s representatives to reproduce redacted parts of this report that strongly back Hunter’s claim of being hacked.

“They Were Trying to Boot the Machine:” John Paul Mac Isaac Claims the FBI Really WERE That Incompetent

/164 Comments/in , , , /by

If you can believe John Paul Mac Isaac, the FBI did some incredibly bone-headed things after they obtained Hunter Biden’s laptop in December 2019. As he describes it in his book (which I read recently while stuck in a hospital awaiting foot surgery), on the very same day the FBI collected the laptop purported to belong to Hunter Biden, on December 9, 2019, someone named “Matt” told Mac Isaac they had tried to boot it up.

“Hi, my name is Matt,” said a voice I didn’t recognize. “I work with Agent DeMeo and Agent Wilson. Do you have a second? I have some questions about accessing the laptop.”

Confused, I responded, “Sure, what’s going on?”

“Did the laptop come with any cables or a charger? How can I connect the drive to a PC? When I plug it in, it wants to format the drive,” Matt said.

“PCs can’t natively read Mac-formatted disks. You will only be able to access the drive from another Mac.”

This is fairly common knowledge among most computer users, and I was surprised that any kind of tech person wouldn’t know it.

“Sadly, Hunter never left the charger or any other cables,” I went on. “I have a charger and everything you need back at the shop. You guys are welcome to it.”

I was feeling really uncomfortable. This Matt guy definitely didn’t seem to have the training or resources to be performing a forensic evaluation of the laptop. Hadn’t the whole reason for taking the laptop been to get it to a lab for proper evaluation and dissemination?

“Tell him we’re OK and we won’t need to go back to his shop,” Agent DeMeo said in the background. “We’ll call you back if we need to,” Matt said before hanging up.

[snip]

“Hi, it’s Matt again. So, we have a power supply and a USB-C cable, but when we boot up, I can’t get the mouse or keyboard to work.”

I couldn’t believe it—they were trying to boot the machine!

“The keyboard and trackpad were disconnected due to liquid damage. If you have a USB-C–to–USB-A adaptor, you should be able to use any USB keyboard or mouse,” I said. He related this to Agent DeMeo and quickly hung up.

Matt called yet again about an hour later.

“So this thing won’t stay on when it’s unplugged. Does the battery work?”

I explained that he needed to plug in the laptop and that once it turned on, the battery would start charging. I could sense his stress and his embarrassment at having to call repeatedly for help. [my emphasis]

To be sure, you can’t believe Mac Isaac.

His own story is riddled with questionable details and important discrepancies.

The most important discrepancy is his description of the laptop he turned over to the FBI, which he describes as a 2016 Mac, not the 2018 Mac identified by serial number.

I moved on to the last Mac, a thirteen-inch 2016 MacBook Pro. The drive was soldered onto the logic board. This one powered on but then would shut down. I suspected that there was a short in the keyboard or trackpad, and if I took it apart, I could at least get it to boot and possibly recover the data.

As I understand it, Mac Isaac’s claims that the hard drive was soldered onto the logic board is also inconsistent with the known details of the laptop shared with the FBI.

But there are important other discrepancies between the story Mac Isaac tells and the one the government tells. In his timeline of his interactions with the FBI, Mac Isaac gets the date for the actual handoff, December 9, correct, but other dates he uses differ from those that show up in Gary Shapley’s timeline. For example:

  • Mac Isaac says that Agent Josh Wilson (who is mentioned in Shapley’s notes) reached out to his father on November 1; Shapley’s notes say that happened on November 3
  • Mac Isaac says that Wilson called him on November 4; Shapley’s notes say that happened on November 6
  • Mac Isaac says that Wilson came to his home on November 19; Shapley’s notes say that happened on November 7

These discrepancies aren’t all that important, legally. But Mac Isaac’s dates seem tailored to the impeachment proceedings going on in the same period, and so to laying a foundation for sharing the laptop with Rudy Giuliani.

A far more important set of discrepancies pertain to Mac Isaac’s description of what happened on December 9, 2019.

The blind computer repairman first describes that the second agent, Agent Mike DeMeo, called him to ask for the device identifiers that morning, before coming to the shop to pick up the device.

Agent DeMeo called around 9:30 a.m. It caught me a little off guard. The only other time we had communicated was shortly after our meeting almost three weeks earlier. He had asked me then to text him the timeline of my interaction with Hunter. I figured that he wanted something in writing showing the chain of custody—or it was an effort to trap me into writing something that could be twisted into a charge of lying to the FBI.

This time, he asked me to text him the model and serial number of the external drive and laptop. I explained that I hadn’t made it to the shop yet. “I need this information before we head over,” he insisted. “It’s important.”

“Give me thirty-five minutes,” I responded, then hung up. I finished getting ready and headed to the shop. After texting the numbers to Agent DeMeo, I waited in the shop with the blinds closed and the lights out, so as not to announce that the store was open. [my emphasis]

Shapley described that the FBI obtained and confirmed the device identifier before they ever met Mac Isaac, on November 6 (though perhaps Mac Isaac only referred to other identifiers needed for the subpoena).

Nevertheless, this discrepancy is important for a number of reasons, not least that if the FBI looked at all closely at the returns on a subscriber subpoena to Apple, it should have raised significant alarm that someone was trying to hack Hunter Biden. But if they didn’t obtain this information until the day they obtained the laptop, then they couldn’t have reviewed the subscriber data very closely in advance. That negligence might, in turn, amount to negligence in missing clear signs that the then former VP’s son was being hacked.

As Mac Isaac describes it, it was not until Agents arrived at his shop that they told him they were going to seize the laptop with a subpoena rather than imaging the laptop there at the shop.

Both agents arrived at my door about a half hour late. “Where’s the tech?” I asked, holding the door open.

“We have a change of plans,” Agent Wilson responded. “Can we go in the back?”

I led the agents to the back, and Agent Wilson placed his bag on the workbench. “

I have a subpoena here to collect the laptop, the drive, and all paperwork associated with the equipment,” he said, pulling out a collection of very formal and important-looking paperwork. “I’ll need you to sign it.”

When Mac Issac asked why they had changed their plan, he claims, lead Agent Josh Wilson deferred to Agent Mike DeMeo, who told him that they were taking the laptop back to a lab to image.

“You guys scared the shit out of me!” I exclaimed. “So why the change of plans? Don’t get me wrong; I’m grateful that you’re taking this stuff out of my shop.”

Agent Wilson looked over at Agent DeMeo, who was buried in his clipboard. “Ah, Mike?” he said. Agent DeMeo paused his writing and said, “We have a lab that takes these things and is better equipped than our field tech.”

Mac Isaac also claims that at that same meeting, DeMeo told him only to contact him, not Wilson.

“Tell them you keep abandoned equipment offsite, like a warehouse location,” Agent DeMeo answered, taking over. “Tell them it will take a day for you to check and they should call back the next day. Then immediately text me at my cell number. From now on, only communicate through my cell number. Not Agent Wilson, just me. We need to avoid communicating through, ah, normal channels. I’m sure you can understand. Text me and we will get the equipment back to you and deal with the situation.”

This communication works the opposite of the way you’d expect. Often, second agents are asked to take the stand, so you’d want them to have a clean digital trail. Here, the lead agent, Agent Wilson, was protecting his communications, whereas the second agent was not.

And then, as Mac Isaac tells it, that very same day, someone else, “Matt,” called using DeMeo’s phone, asking really embarrassing questions about how to access the laptop.

The claim that someone at the FBI was trying to boot up the laptop is alarming enough — though as I noted in July, there is some corroboration for the claim in Gary Shapley’s notes.

FBI determined in order to do a full forensic review a replacement laptop had to be purchased so the hard drive could be installed, booted and imaged.

[snip]

Josh Wilson stated that (while laughing) so whoever [people wanting to review the laptop] are they are going to have to buy a laptop to put the hard drive so they can read it.

Where Mac Isaac’s claims are totally inconsistent with the FBI claims, in a way that would cause grave legal problems for the FBI, is the date: Mac Isaac claims that the FBI was trying to boot up the laptop that same day, on December 9.

According to Gary Shapley’s notes, the FBI didn’t have approval to even get a warrant on December 9, much less have a signed warrant itself.

The FBI didn’t have a warrant to access the “Hunter Biden” “laptop” until December 13.

And yet, if you can believe Mac Isaac, the FBI was already trying to boot it up, perhaps irreparably altering its contents, three days before they got a warrant.

Featured image showing known dissemination of the “Hunter Biden” “laptop” by Thomas Fine.

Hunter Biden’s Matryoshka Cell Phone: How the IRS and Frothers Got Hunter’s Encrypted iPhone Content

/88 Comments/in , /by

Believe it or not, what sent me down the rabbit hole of Hunter Biden’s “laptop” was not the laptop itself.

It was a cell phone.

Or, more specifically, it was two details in purported IRS whistleblower Gary Shapley’s testimony. First, after introducing summaries from some Hunter Biden WhatsApp chats — summaries that, Abbe Lowell claimed, got the most basic details wrong — Shapley explained that the chats didn’t come from the laptop itself, they came from a warrant served on Apple for the iCloud backup to which they were saved.

Q Could you tell us about this document, what is it, and how was it obtained —

A Sure. So there was an electronic search warrant for iCloud backup, and these messages were in that backup and provided —

Q Okay.

A — from a third party, from iCloud.

This appears to be the search warrant return obtained — again, per Shapley’s testimony — in August 2020.

For example, in August 2020, we got the results back from an iCloud search warrant. Unlike the laptop, these came to the investigative team from a third-party record keeper and included a set of messages. The messages included material we clearly needed to follow up on.

Shapley’s disclosure that there were WhatsApp texts saved to iCloud stunned me. That’s because, for all the material produced from the laptop itself — which even frothers have treated as all the content in Hunter Biden’s iCloud account — I had never seen WhatsApp texts.

Plus, there’s a technical issue. WhatsApp texts, like Signal texts, don’t automatically back up to iCloud. If one really wants to use their end-to-end encryption to best advantage, one doesn’t store them in the cloud, because then the only easy way to get the texts would be directly from someone’s phone. These texts purported to involve a Chinese national (though, as noted, Lowell says that’s false) whose phone would presumably be inaccessible overseas. And at the time the IRS obtained these texts, Hunter Biden didn’t know about the investigation into himself. They hadn’t seized his phone.

For Shapley’s description to be true, then, Hunter Biden would have had to back up the texts to his iCloud. But if he had, they should have shown up on the laptop itself, right along with every other scrap of the President’s son’s private life.

There were crumbs of an explanation for this in Shapley’s notes from the October 22, 2020 meeting on the government’s treatment of the laptop attributed to Hunter Biden.

In the meeting, Whistleblower X — who by his own description saw things online that he hadn’t obtained via the laptop directly, even though DOJ warned the agents not to do that — kept prodding about whether the investigative team had been provided all the messages on the laptop.

29. SA [Whistblower X] asked if all information on the hard drive had been reviewed…the answer is that they did not look at all of that SA [Whistleblower X] questions if Dillon reviewed all iMessage’s that wore relevant and not privileged. They would find the answer.

As Shapley recorded, on February 27, 2020, the forensics people provided all messages from the hard drive of material John Paul Mac Isaac restored from the laptop.

30. 2/27/2020 DE3 with all messages from the hard drive were provided by computer forensics— via USB Drive

That production included iPad and MacBook messages, but no iPhone messages.

32. 227 Productions

DE3 USB containing exported messages (ipad and macbook messages) No iphone messages

They didn’t get messages off any iPhone until they found a password, conveniently written on a business card, and with that password, were able to get into encrypted iPhone content on the laptop.

Laptop — iphone messages were on the hard drive but encrypted they didn’t get those messages until they looked at laptop and found a business card with the password on it so they were able to get into the iphone messages [my emphasis]

This still didn’t answer my question — how was the IRS able to get WhatsApp texts from iCloud when they weren’t on the iCloud content that appears on the Hunter Biden laptop.

But a detail on the fourth of Guy Dimitrelos’ reports on Hunter Biden’s laptop may explain it.

In his first report, Dimitrelos explained that the 5 million artifacts found on the hard drive were connected to Hunter Biden’s iCloud account, which he says was tied to the email [email protected].

  1. The hard drive contained approximately 5,791,819 files and system artifacts and was connected to and authenticated on an Apple iCloud account of [email protected] which is owned by Robert Hunter Biden (RHB).

[snip]

  1. Since this Apple MacBook Pro model was not released until 2017, all data prior to 2017 was stored (backed-up) to the [email protected] account and then downloaded to the MacBook Pro hard drive Downloads folder as illustrated in paragraph 30.

In his fourth report — basically 133 pages into his sequential reporting — Dimitrelos noted that Hunter Biden had another iCloud account, one tied to one of the emails he identified on page 4 of his report: [email protected].

In fact, at least according to the unreliable emails released at BidenLaptopEmails dot com (AKA MarcoPolo), that’s the account to which the laptop believed to be the one that ended up at Mac Isaac’s shop was registered to, not the [email protected] account.

At the Marco Polo site, there are 453 pages of emails from the [email protected] account (so around 22650). They include some of the most interesting in the collection, the ones directly with the Biden family and others indicating sensitive travel. There are 269 from the [email protected] account (so around 13,450) — but it’s the latter that seems to have been taken over in early 2019. I’ve described that the droidhunter88 gmail account effectively took over control of the iCloud account in that period (though I need to go back to the timeline and distinguish which events happened on one iCloud account and which on the other), and I think that’s right. But importantly, at times, the RosemontSeneca email is linked into it. That is, a RosemontSeneca email was used on both iCloud accounts.

As to the phone, Dimitrelos describes that he found a phone registered to the [email protected] account in an encrypted container in an iTunes backup.

I identified an encrypted container located within Apple’s MobileSync iTunes default backup folder.

[snip]

I identified the iOS backup to be an iPhone with the phone number below and Apple id of

[email protected] which is one of Robert Hunter Biden’s iCloud accounts.

Part two of Dimitrelos’ report described finding passwords for the iTunes account in two places. First, a picture of a partly rumpled lined piece of paper stored in a Hidden Album. This picture included Amazon, WiFi, iTunes, GMail, and Apple ID passwords, all registered to a different Gmail account. And then, associated with an iPad registered to still a third iCloud account, registered to a Gmail account.

The latter shows that Hunter Biden’s iTunes password was changed on January 30, 2019, solidly in the middle of the period I’ve argued that his account was taken over by the DroidHunter gmail account.

And screencaps in parts two and four of Dimitrelos’ report show that both the iPad and the iPhone were backed up during this same period, on February 6, 2019. Someone changed the iTunes password, and backed up these two devices, where they were found on the laptop. All in this same period where Hunter Biden seems to have lost control over his laptop.

In part four of Dimitrelos’ report, he describes that there were, indeed, WhatsApp messages on the iPhone, registered to that entirely different iCloud account, seemingly backed up to iTunes on the [email protected] account.

I can’t be sure about this, because I’m not a forensics expert, both Shapley and Dimitrelos are deliberately unreliable narrators, and even they don’t have all the data to understand what went on here. But it appears that the reason why there were no WhatsApp texts on the laptop itself, which had all the content in the [email protected] iCloud account, is that they weren’t used by a device registered to the [email protected] iCloud account. They were used by a device registered to the [email protected] account, which was (as Shapley’s notes reflect) stored in encrypted fashion on the laptop.

There’s one more very important point about this.

The government had a warrant. If they really did find a business card (one not described anywhere I’ve seen in Dimitrelos’ report) with a password, they were able to get the encrypted content (though oftentimes prosecutors will recommend you go back and get a second warrant for that). From there, it seems, the IRS got another warrant for the other iCloud account, the [email protected] one. That’s how they got a legally sound copy of the WhatsApp texts in August 2020.

But for people like Rudy Giuliani or Garrett Ziegler or John Paul Mac Isaac, taking a laptop they purport to have been abandoned, and then using a password found on that laptop to access an encrypted container — especially one of a different iCloud account — is legally another level of conduct.

Update: I screwed up the number of emails; I’ve corrected that now.

The Laptop Everyone Knows as Hunter Biden’s Appears to Have Been Deleted Starting February 15, 2019

/111 Comments/in , , , /by

I’ve been wading through Hunter Biden data all weekend. There’s some evidence that the descriptions of the “Hunter Biden” “laptop” based on the drive Rudy Giuliani has peddled do not match the description of what should be on such devices given what the FBI and IRS saw.

Before I explain that, though, I want to talk about how the life of Hunter Biden’s iCloud account differs from what is portrayed in this analysis paid for by Washington Examiner.

As that report describes, Hunter Biden activated a MacBook Pro on October 21, 2018, then set it up with Hunter’s iCloud on October 22. Hunter then used the MacBook as his primary device until March 17, 2019, a month before it waltzed into John Paul Mac Isaac’s computer repair shop to start a second act as the biggest political hit job ever.

There are problems with that story. A longer table of the devices that logged into Hunter Biden’s iCloud includes devices that appear to have been accessing core Hunter Biden content.

That same table doesn’t show any access after November 15, 2018, with the last access being the device Roberts MacBook Pro that would end up in a Delaware repair shop, but showing up six days earlier than it should. There’s a phone that should but does not show up in those devices, too.

The report doesn’t discuss the import of the shifts between these emails.

RHB used several emails for business and personal use including:
○ [email protected] [sic]
○ [email protected] ([email protected])
○ [email protected]
○ [email protected]
○ [email protected]

One email missing from this list is a Gmail account under which a bunch of passwords were stored. That’ll become important later.

The most important email is the Gmail account (misspelled above), [email protected], which Hunter Biden used to contact sex workers, probably including the Russian escort service that the IRS used to predicate the IRS investigation. That email account got added to his iCloud account at the same time as his iCloud contents were requested, and then again before the MacBook stopped being used. Those changes often happened in conjunction with changes to the phone number.

For now, though, I just want to map out the major events with Hunter’s iCloud accounts from September 1, 2018 (perhaps the months before the IRS would open an investigation into him because he was frequenting a Russian escort service) until the final email as found on the laptop itself. There’s a bunch more — one after another credit card gets rejected, and he keeps moving his Wells Fargo card over to pay for his Apple account; the iCloud account shows Hunter reauthorizing use of biometrics to get into his Wells Fargo account in this period.

In January 2019, the Gmail account Hunter Biden used to contact sex workers (probably including the Russian escort service he had been using) effectively took over his iCloud account and asked for a complete copy of his iCloud account. Then, the next month, all the data on the Hunter Biden laptop was deleted.

Update: I’ve taken the reference to the HB RediPhone out altogether–it’s clear that’s a branded iPhone–and replaced it with a better explanation of the other devices.

Update: I see that he does have D[r]oidhunter88, but doesn’t discuss the import of it.

Update: I’ve added a few things that happened while Hunter’s account was pwned. Importantly, as part of this process an app called “Hunter” was given full access to his droidhunter88 gmail account. There are also a few emails that seem to be a test process.

Update: Added the missing Gmail account.

Hunter Biden’s iCloud

9/1/18: An account recovery request for your Apple ID ([email protected]) was made from the web near Los Angeles, CA on August 31, 2018 at 9:36:07 PM PDT. The contact phone number provided was [Hunter Biden’s].

9/1/18: The following changes to your Apple ID, [email protected] were made on September 1, 2018 at 10:29:36 AM PDT: Password

9/1/18: Your Apple ID ([email protected]) was used to sign in to iCloud on a MacBook Pro 13″.
Date and Time: September 1, 2018, 10:34 AM PDT

9/1/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser.
Date and Time: September 1, 2018, 10:42 AM PDT

9/2/18: Your Apple ID, [email protected], was just used to download Hide2Vault from the Mac App Store on a computer or device that has not previously been used.

9/2/18: Welcome to your new MacBook Pro with Touch Bar.

9/11/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser.

9/11/18: The password for your Apple ID ([email protected]) has been successfully reset.

9/11/18: Robert’s iPad is being erased. The erase of Robert’s iPad started at 2:56 PM PDT on August 5, 2018.

This is one of several times in several weeks that Hunter loses his iPhone, but while it’s lost, someone also pings his MacBook.

9/16/18: A sound was played on iPhone. A sound was played on iPhone at 8:25 PM PDT on September 15, 2018. (Repeats 25 times in 5 minutes)

9/16/18: A sound was played on Robert’s MacBook Pro at 8:30 PM PDT on September 15, 2018. (Repeats 2 times)

9/16/18: A sound was played on iPhone at 8:31 PM PDT on September 15, 2018. (Repeats 7 times)

9/16/18: iPhone was found near Santa Monica Mountains National Recreation Area 23287 Palm Canyon Ln Malibu, CA 90265 United States at 11:32 PM PDT.

9/16/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser.

9/19/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser.

9/20/18: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone 8 Plus.

This is the second time he loses his phone. What follows is basically a chase of Hunter Biden’s iPhone across LA. It’s not clear it is ever recovered — but it is over two weeks before a new iPhone logs into his account.

9/27/18: Lost Mode enabled on Robert Hunter’s iPhone. This device was put into Lost Mode at 7:20 PM PDT on September 27, 2018.

9/27/18: Robert Hunter’s iPhone was found near [address redacted] Lynwood, CA 90262 United States at 7:20 PM PDT.

9/27/18: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone 8 Plus.

9/27/18: A sound was played on Robert Hunter’s iPhone at 7:20 PM PDT on September 27, 2018.

9/27/18: A sound was played on Robert Hunter’s iPhone at 7:20 PM PDT on September 27, 2018.

9/27/18: Robert Hunter’s iPhone was found near [address redacted] Lynwood, CA 90262 United States at 7:20 PM PDT.

9/28/18: Robert Hunter’s iPhone was found near [different address redacted] Lynwood, CA 90262 United States at 4:24 PM PDT.

9/28/18: Robert Hunter’s iPhone was found near [third address redacted] Lynwood, CA 90262 United States at 5:27 PM PDT.

9/28/18: Robert Hunter’s iPhone was found near [fourth address redacted] Los Angeles, CA 90036 United States at 6:22 PM PDT.

9/28/18: Robert Hunter’s iPhone was found near [fifth address redacted] Los Angeles, CA 90069 United States at 6:38 PM PDT.

10/13/18: Bobby Hernandez to [email protected]: You left your phone. How do I get it to you?

10/14/18: The password for your Apple ID ([email protected]) has been successfully reset.

By date, this login is the HB rediPhone, but Apple recognized it as an iPhone X.

10/14/18: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone X. Date and Time: October 14, 2018, 11:24 AM PDT

10/17/18: The password for your Apple ID ([email protected]) has been successfully reset.

10/17/18: The following information for your Apple ID (r•••••@rspdc.com) was updated on October 17, 2018. Trusted Phone Number Added – Phone number ending in 73

10/17/18: New sign-in to your linked account [email protected] Your Google Account was just signed in to from a new Apple iPhone device.

Per the Gus Dimitrelos report, the following activity reflects the creation of a new MacBook account called Robert’s MacBook Pro — the laptop that would end up in Mac Isaac’s shop. But there doesn’t appear to be an alert for a new device like there is the for the iPhone 8 Plus the following day.

10/21/18: Your Apple ID ([email protected]) was used to sign in to iCloud on a MacBook Pro 13″. Date and Time: October 21, 2018, 5:50 AM PDT

10/21/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: October 21, 2018, 9:06 AM PDT

10/22/18: The following changes to your Apple ID, [email protected] were made on October 22, 2018 at 7:47:30 PM EDT: Phone number(s)

10/23/18: Your Apple ID, [email protected], was just used to download Quora from the App Store on a computer or device that has not previously been used.

10/23/18: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone 8 Plus. Date and Time: October 23, 2018, 4:10 PM PDT

10/23/18: New sign-in to your linked account [email protected] Your Google Account was just signed in to from a new Apple iPhone device.

Several spyware apps get purchased in this period.

10/29/18: Your mSpy credentials to your control panel: Username/Login: [email protected]

11/2/18: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone XS.

11/16/18: You recently added [email protected] as a new alternate email address for your Apple ID.

11/21/18: You’ve purchased the following subscription with a 1‑month free trial: Subscription Tile Premium

11/22/18: Your Apple ID, [email protected], was just used to download KAYAK Flights, Hotels & Cars from the iTunes Store on a computer or device that has not previously been used.

12/28/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: December 28, 2018, 7:06 AM PST

1/3/19: Keith Ablow (then Hunter’s therapist) says Hunter’s email is screwed up

1/6/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: January 6, 2019, 1:51 AM PST

1/12/19: Your Recent Mac Cleanup Pro Order [ADV181229-7742-90963]

1/14/19: The following changes to your Apple ID, [email protected] were made on January 13, 2019 at 10:28:31 PM EST: Phone number(s)

1/14/19: The following changes to your Apple ID, [email protected] were made on January 13, 2019 at 10:31:15 PM EST: Password

1/14/19 The following changes to your Apple ID, [email protected] were made on January 13, 2019 at 10:52:13 PM EST: Billing and/or Shipping Information

1/14/19: The following changes to your Apple ID, [email protected] were made on January 13, 2019 at 10:53:40 PM EST: Phone number(s)

1/14/19: The following changes to your Apple ID, [email protected] were made on January 13, 2019 at 11:12:45 PM EST: Billing Information

1/16/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: January 16, 2019, 1:59 PM PST

While Hunter is in Ketamine treatment at Keith Ablow’s, a service called “Hunter” gets access to the droidhunter88 gmail account

1/16/19: Here’s my first tip for you!

1/16/19: Hi Robinson, Hunter now has access to your Google Account [email protected].

Hunter can:
View your email messages and settings
Manage drafts and send emails
Send email on your behalf

A bunch of things happen in this four day period: first, someone accessed droidhunter88 from a new iPhone. Someone changed the phone number for the Hunter Biden iCloud. Then, droidhunter88 was given access to the iCloud account. Then the iCloud account ordered all of Hunter’s iCloud contents. Then the password for the account was reset.

1/17/19: New device signed in to [email protected] Your Google Account was just signed in to from a new Apple iPhone device.

1/17/19: I am here to help you find the emails you need!

Giovanni here from Hunter.

I wanted to quickly check if I can help you getting started with Hunter.

There are plenty of functionalities included with your free plan that will allow you to find, verify and enrich a set of data in bulk: these are all explained in our video guides.

However, if you already have a precise task to perform, reply to this email so I can better assist you!

1/17/19: n (from [email protected])

1/18/19: Long email to tabloid journalist sent under rosemontseneca email (this is sent first to Keith Ablow and then George Mesires, the latter of whom responds); this would have shown how the email account worked

1/19/19: The following information for your Apple ID (r•••••@rspdc.com) was updated on January 19, 2019. Trusted Phone Number Removed – Phone number ending in 13

1/20/19: The following changes to your Apple ID, [email protected] were made on January 20, 2019 at 5:24:54 PM EST: Phone number(s)

1/20/19: The following changes to your Apple ID, [email protected] were made on January 20, 2019 at 5:31:21 PM EST: Apple ID
Email address(es)

1/20/19: The following changes to your Apple ID, [email protected] were made on January 20, 2019 at 5:31:21 PM EST: Apple ID Email address(es)

1/20/19: A request for a copy of the data associated with the Apple ID [email protected] was made on January 20, 2019 at 5:40:26 PM EST

1/21/19: The password for your Apple ID ([email protected]) has been successfully reset.

1/21/19: The following changes to your Apple ID, [email protected] were made on January 21, 2019 at 8:28:05 AM EST: Name — changed from Robert Hunter to Robert Biden

1/21/19: You recently added [email protected] as the notification email address for your Apple ID

1/21/19: The following changes to your Apple ID, [email protected] were made on January 21, 2019 at 8:31:02 AM EST:
Rescue email address

1/22/19: The following information for your Apple ID (r•••••@icloud.com) was updated on January 22, 2019. Trusted Phone Number Removed – Phone number ending in 96

1/22/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: January 22, 2019, 4:21 AM PST

1/22/19: The following changes to your Apple ID, [email protected] were made on January 22, 2019 at 10:05:20 AM EST:
Email address(es)

1/22/19: The following changes to your Apple ID, [email protected] were made on January 22, 2019 at 10:05:29 AM EST:
Email address(es)

1/22/19: The following changes to your Apple ID, [email protected] were made on January 22, 2019 at 10:05:34 AM EST:
Email address(es)

1/24/19: You recently added [email protected] as a new alternate email address for your Apple ID.

I think that after ordering all Hunter’s data, the account is reset to what it had been from the start. But Droidhunter88, not [email protected], gets the iCloud backup.

1/24/19: Your contacts have been restored successfully on January 24, 2019, 1:17 PM PST.

1/25/19: The data you requested on January 20, 2019 at 5:40:26 PM EST is ready to download. [Sent to both Droidhunter88 and [email protected]]

1/27/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: January 27, 2019, 7:41 AM PST

Several photo editing apps are purchased in this period (and one CAD app).

1/27/19: You’ve purchased the following subscription with a 1‑month free trial: Subscription Polarr Photo Editor Yearly

2/6/19: The following changes to your Apple ID, [email protected] were made on February 5, 2019 at 11:39:09 PM EST: Phone number(s)

2/9/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: February 9, 2019, 9:52 AM PST

2/9/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: February 9, 2019, 5:08 PM PST

Hunter connected to your Google Account
Hi Robinson,

2/9/19: Hunter now has access to your Google Account [email protected].

2/9/19: test To:[email protected]

2/9/19: jkFrom:”Robinson Hunter” [email protected]:[email protected]

2/9/19: The following information for your Apple ID (r•••••@icloud.com) was updated on February 10, 2019. Trusted Phone Number Added – Phone number ending in 96

2/9/19: You recently added [email protected] as the notification email address for your Apple ID.

2/9/19: You recently added [email protected] as the notification email address for your Apple ID

2/9/19: The following changes to your Apple ID, [email protected] were made on February 9, 2019 at 8:33:57 PM EST: Rescue email address

2/9/19: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone 6s. Date and Time: February 9, 2019, 6:11 PM PST

2/10/19: Your Apple ID, [email protected], was just used to download Call recorder for iphone from the iTunes Store on a computer or device that has not previously been used.

2/15/19: Hi Robinson, Did you know? Hunter doesn’t have only one Chrome extension! We recently built a simple email tracker for Gmail.

This is where the data on the MacBook that would end up in Mac Isaac’s shop started getting deleted.

2/15/19: Robert’s MacBook is being erased. The erase of Robert’s MacBook started at 4:18 PM PST on February 15, 2019.

2/15/19: Robert’s MacBook Pro has been locked. This Mac was locked at 8:36 PM PST on February 15, 2019.

2/19/19: Noiseless MacPhun LLC

2/20/19: where the fuck are youi? from DroidHunter88 to dpagano:

this is hunter
i dont have your #

call me please

The droidhunter88 account bought a new iPhone — but, after telling Apple they would recycle the old one, instead kept it. That would effectively be another device associated with Hunter Biden. Given some of the other apps involved, this may have served as a way to get Hunter Biden’s calls (eg, from Mac Isaac). Unlike the new devices that show up in 2018, this one was paid for. 

2/21/19: New device signed in to [email protected] Your Google Account was just signed in to from a new Apple iPhone device.

2/21/19: Hi Robinson, Welcome to Google on your new Apple iPhone (tied to droidhunter88)

2/28/19: Your items are ready for pickup.Order Number: W776795632Ordered on: February 28, 2019

2/28/19: Your trade-in has been initiated. Thanks for using Apple GiveBack.

3/1/19: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone XR. Date and Time: March 1, 2019, 8:52 AM PST

3/5/19: Recently you reported an issue with Polarr Photo Editor, Polarr Photo Editor Yearly using iTunes Report a Problem

3/7/19: Your Apple ID, [email protected], was just used to download Lovense [sic] Remote from the App Store on a computer or device that has not previously been used.

3/9/19: New sign-in to your linked account [email protected] Your Google Account was just signed in to from a new Apple iPhone device.

3/9/19: Promise Me, Dad: A Year of Hope, Hardship, and Purpose (Unabridged)

3/13/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: March 13, 2019, 5:43 PM PDT

3/16/19: The following changes to your Apple ID, [email protected] were made on March 16, 2019 at 11:59:16 PM EDT:Email address(es)

Droidhunter88 is added back to Hunter’s iCloud contact again.

3/17/19: You recently added [email protected] as a new alternate email address for your Apple ID.

3/17/19: The following changes to your Apple ID, [email protected] were made on March 17, 2019 at 12:02:06 AM EDT: Email address(es)

3/17/19: We haven’t received your device.